CVE-2021-42362
HIGHWordPress Popular Posts <= 5.3.2 - Authenticated Arbitrary File Upload in Image.php
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2021-42362.
PoCs published by Simone Cristofaro, samiba6, simonecris, including Metasploit module exploits/multi/http/wp_popular_posts_rce.
AI-analyzed exploit summary This exploit leverages an authenticated RCE vulnerability in WordPress Popular Posts plugin <= 5.3.2 by uploading a malicious GIF file disguised as a PHP shell via custom fields. It requires contributor-level access and the GD PHP extension to be enabled.
Description
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.
Exploits (4)
This exploit leverages an authenticated RCE vulnerability in WordPress Popular Posts plugin <= 5.3.2 by uploading a malicious GIF file disguised as a PHP shell via custom fields. It requires contributor-level access and the GD PHP extension to be enabled.
This PoC exploits an arbitrary file upload vulnerability in the WordPress Popular Posts plugin (CVE-2021-42362) by uploading a malicious GIF file containing PHP code to achieve remote code execution. It authenticates as a contributor-level user, configures plugin settings to enable thumbnail generation, and uploads the payload via a third-party file hosting service.
This PoC exploits a case-insensitive file extension bypass in the SP Project & Document Manager WordPress plugin (CVE-2021-42362) to upload a malicious PHP file disguised as an image. It then leverages the WordPress Popular Posts plugin to execute the uploaded shell via thumbnail generation.
This Metasploit module exploits an authenticated RCE vulnerability in WordPress Popular Posts plugin <= 5.3.2 by leveraging improper input validation to upload a malicious PHP payload disguised as a GIF image. The exploit chain involves reconfiguring plugin settings, creating a post, and triggering payload execution via the widget.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H