GitHub Advisoryadvisory · Packagist

GHSA-wxg6-f773-g2f7 jQuery File Upload Plugin Unrestricted file upload vulnerability

HIGH Published 2022-05-17 Modified 2024-04-25 Official page ↗
Aliases
CVE-2014-8739
Ecosystem
Packagist
Packages
blueimp/jquery-file-upload
Severity
High
Weaknesses
CWE-434
Reviewed
2024-04-25

Affected packages

• Packagist blueimp/jquery-file-upload: 6.4.4 (no fix yet)

Description

Unrestricted file upload vulnerability in `server/php/UploadHandler.php` in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in `files/`, as exploited in the wild in October 2014.

Related

Alias · CVE (1)

  • CVE-2014-8739 Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References