CVE-2014-8739 : Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.

Published 2020-02-08 18:15:11

Updated 2020-02-12 18:37:10

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2014-8739

EPSS FAQ

93.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-8739

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2014-8739

http://www.openwall.com/lists/oss-security/2014/11/11/4

oss-security - CVE request: Joomla component com_sexycontactform and WordPress plugin sexy-contact-form unrestricted file upload
Mailing List;Third Party Advisory
http://osvdb.org/show/osvdb/113673

Broken Link
https://wordpress.org/plugins/sexy-contact-form/changelog/

Creative Contact Form – WordPress plugin | WordPress.org
Third Party Advisory
https://www.exploit-db.com/exploits/36811/

WordPress Plugin Creative Contact Form - Arbitrary File Upload (Metasploit) - PHP remote Exploit
Exploit;Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2014/11/13/3

oss-security - Re: CVE request: Joomla component com_sexycontactform and WordPress plugin sexy-contact-form unrestricted file upload
Mailing List;Third Party Advisory
https://www.exploit-db.com/exploits/35057/

WordPress Plugin 0.9.7 / Joomla! Component 2.0.0 Creative Contact Form - Arbitrary File Upload - PHP webapps Exploit
Exploit;Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2014/11/11/5

oss-security - Re: CVE request: Joomla component com_sexycontactform and WordPress plugin sexy-contact-form unrestricted file upload
Mailing List;Third Party Advisory
http://osvdb.org/show/osvdb/113669

Broken Link

Products affected by CVE-2014-8739

Creative-solutions » Creative Contact Form » For Joomla!
Versions before (<) 2.0.1
cpe:2.3:a:creative-solutions:creative_contact_form:*:*:*:*:*:joomla\!:*:*
Matching versions
Creative-solutions » Creative Contact Form » For Wordpress
Versions before (<) 1.0.0
cpe:2.3:a:creative-solutions:creative_contact_form:*:*:*:*:*:wordpress:*:*
Matching versions
Jquery File Upload Project » Jquery File Upload » Version: 6.4.4
cpe:2.3:a:jquery_file_upload_project:jquery_file_upload:6.4.4:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2014-8739

Exploit prediction scoring system (EPSS) score for CVE-2014-8739

CVSS scores for CVE-2014-8739

CWE ids for CVE-2014-8739

References for CVE-2014-8739

Products affected by CVE-2014-8739