File Manager <= 6.8任意文件上传漏洞

详细信息

漏洞类型

代码问题

漏洞描述

WordPress的File Manager (wp-file-manager)插件6.9之前版本允许远程攻击者上传和执行任意PHP代码，因为它将不安全的示例elFinder连接器文件重命名为.PHP扩展名。允许攻击者运行elFinder upload (or mkfile and put)命令，将PHP代码写入wp-content/plugins/wp文件管理器/lib/files/目录。

修复建议

更新到6.9版或更新的修补版本。参考链接： https://wordpress.org/plugins/wp-file-manager/

参考链接

• http://packetstormsecurity.com/files/160003/WordPress-File-Manager-6.8-Remote-Code-Execution.html

  NVD · Third Party Advisory · VDB Entry · Exploit

• http://packetstormsecurity.com/files/171650/WordPress-File-Manager-6.9-Shell-Upload.html

  NVD · Third Party Advisory · VDB Entry · Exploit

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25213/

  WPScan

• https://github.com/w4fz5uck5/wp-file-manager-0day

  NVD · Third Party Advisory · Exploit

• https://hotforsecurity.bitdefender.com/blog/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html

  NVD · Third Party Advisory

• https://plugins.trac.wordpress.org/changeset/2373068

  NVD · Patch

• https://seravo.com/blog/0-day-vulnerability-in-wp-file-manager/

  NVD · Third Party Advisory · Exploit

• https://wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/

  NVD · Third Party Advisory · Exploit

• https://wordpress.org/plugins/wp-file-manager/#developers

  NVD · Release Notes · Product

• https://wpscan.com/vulnerability/e528ae38-72f0-49ff-9878-922eff59ace9/

  WPScan

• https://zdnet.com/article/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug/

  NVD · Press/Media Coverage

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25213

  NVD · US Government Resource