Vulnerability Details : CVE-2014-8739
Potential exploit
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
Vulnerability category: Execute code
Products affected by CVE-2014-8739
- cpe:2.3:a:creative-solutions:creative_contact_form:*:*:*:*:*:joomla\!:*:*
- cpe:2.3:a:creative-solutions:creative_contact_form:*:*:*:*:*:wordpress:*:*
- cpe:2.3:a:jquery_file_upload_project:jquery_file_upload:6.4.4:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-8739
78.94%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-8739
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2014-8739
-
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-8739
-
http://www.openwall.com/lists/oss-security/2014/11/11/4
oss-security - CVE request: Joomla component com_sexycontactform and WordPress plugin sexy-contact-form unrestricted file uploadMailing List;Third Party Advisory
-
http://osvdb.org/show/osvdb/113673
Broken Link
-
https://wordpress.org/plugins/sexy-contact-form/changelog/
Creative Contact Form – WordPress plugin | WordPress.orgThird Party Advisory
-
https://www.exploit-db.com/exploits/36811/
WordPress Plugin Creative Contact Form - Arbitrary File Upload (Metasploit) - PHP remote ExploitExploit;Third Party Advisory;VDB Entry
-
http://www.openwall.com/lists/oss-security/2014/11/13/3
oss-security - Re: CVE request: Joomla component com_sexycontactform and WordPress plugin sexy-contact-form unrestricted file uploadMailing List;Third Party Advisory
-
https://www.exploit-db.com/exploits/35057/
WordPress Plugin 0.9.7 / Joomla! Component 2.0.0 Creative Contact Form - Arbitrary File Upload - PHP webapps ExploitExploit;Third Party Advisory;VDB Entry
-
http://www.openwall.com/lists/oss-security/2014/11/11/5
oss-security - Re: CVE request: Joomla component com_sexycontactform and WordPress plugin sexy-contact-form unrestricted file uploadMailing List;Third Party Advisory
-
http://osvdb.org/show/osvdb/113669
Broken Link
Jump to