CVE-2014-8739

EPSS 91.7%◆ VulnCheck KEV

Vexday Risk Score

82Corregir ahora

Decisión SSVC (CISA)

Act

Explotación + impacto → acción inmediata

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 91.7%KEV nãoPoC públicaNuclei simMetasploit simPatch —

Ciclo de vida

22 oct 2014Exploit Metasploit disponible

25 oct 2014PoC pública

08 feb 2020Publicada en NVD

Recomendación: Corregir cuanto antes — hay explotación activa confirmada.

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 5

cve_referencewww.exploit-db.com/exploits/35057/no verificado cve_referencewww.exploit-db.com/exploits/36811/no verificado exploitdbwww.exploit-db.com/exploits/36811no verificado exploitdbwww.exploit-db.com/exploits/35057no verificado vulncheckvulncheck.com/xdb/df3433fb756bno verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://osvdb.org/show/osvdb/113669 http://osvdb.org/show/osvdb/113673 https://wordpress.org/plugins/sexy-contact-form/changelog/https://www.exploit-db.com/exploits/35057/https://www.exploit-db.com/exploits/36811/http://www.openwall.com/lists/oss-security/2014/11/11/4 http://www.openwall.com/lists/oss-security/2014/11/11/5 http://www.openwall.com/lists/oss-security/2014/11/13/3