CVE-2012-3574 - Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community pl

CVE-2012-3574

Summary

Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/temp.

References

Vulnerable Configurations

cpe:2.3:a:tbelmans:mm_forms_community:2.2.5:*:*:*:*:*:*:*
cpe:2.3:a:tbelmans:mm_forms_community:2.2.5:*:*:*:*:*:*:*
cpe:2.3:a:tbelmans:mm_forms_community:2.2.6:*:*:*:*:*:*:*
cpe:2.3:a:tbelmans:mm_forms_community:2.2.6:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*
cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 29-08-2017 - 01:31)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	53852
exploit-db	18997
misc	http://www.opensyscom.fr/Actualites/wordpress-plugins-mm-forms-community-shell-upload-vulnerability.html
secunia	49411
xf	wp-mmforms-doajaxfileupload-file-upload(76133)

Last major update

29-08-2017 - 01:31

Published

16-06-2012 - 00:55

Last modified

29-08-2017 - 01:31