CVE-2014-8739

Katalog CVE

CVSS 9.8 · Critical EPSS 91,7%

Kerentanan Unrestricted Upload of File with Dangerous Type pada creative-solutions creative contact form, jquery file upload project jquery file upload. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.

Rincian

Terbit di NVD

8 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

91,7% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2014/11/11/4 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2014/11/11/5 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2014/11/13/3 mailing list · advisory pihak ketiga
• https://wordpress.org/plugins/sexy-contact-form/changelog/ advisory pihak ketiga
• https://www.exploit-db.com/exploits/35057/ exploit · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/36811/ exploit · advisory pihak ketiga · vdb entry
• http://osvdb.org/show/osvdb/113669 broken link
• http://osvdb.org/show/osvdb/113673 broken link