EUVD-2020-30797CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
Analysis
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulnerability. Attackers can upload PHP files disguised with image extensions and then rename them back to .php using the plugin's built-in rename functionality, bypassing all upload restrictions.
Technical Context
The plugin allows file uploads with extension validation that blocks .php files. However, the rename function is accessible without authentication and performs no extension checks. An attacker uploads a PHP webshell with a .png extension (passing upload validation), then sends a rename request to change the extension from .png to .php. The file is now executable and accessible via the web.
Affected Products
['Simple File List <= 4.2.2', 'Simple File List Pro (same versions)']
Remediation
Update to Simple File List 4.2.3 or later. Configure the web server to deny PHP execution in the plugin's upload directory. Review the upload directory for suspicious PHP files. Add authentication requirements to file management operations.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today