Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal
CVE-2023-1112

4.7MEDIUM

Key Information:

Vendor: Wordpress
Status: Drag And Drop Multiple File Upload Contact Form 7
Vendor: CVE Published:; 1 March 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 24%

What is CVE-2023-1112?

A path traversal vulnerability exists in the Drag and Drop Multiple File Upload Contact Form 7 plugin for WordPress, specifically affecting version 5.0.6.1. The issue arises from improper handling of the upload_name argument in the admin-ajax.php file, which can be exploited to manipulate file paths. This could allow an attacker to execute arbitrary scripts or access sensitive files on the server from a remote location. Given the public disclosure of this vulnerability, it is critical for users to address this issue promptly to mitigate potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-1112 - Proof of Concept
Created by Nickguitar

References

https://vuldb.com/?id.222072

vdb-entrytechnical-description

https://vuldb.com/?ctiid.222072

signaturepermissions-required

https://github.com/Nickguitar/Drag-and-Drop-Multiple-File...

exploit

EPSS Score

24% chance of being exploited in the next 30 days.

CVSS V3.1

Score:

4.7

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

CVSS V3.0