CVE-2008-3362
Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 16.8%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct request to the file in wp-content/plugins/downloads-manager/upload/.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 16.85% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- giulio ganci/wp downloads manager · wordpress/wp downloads manager
- Source
- cve@mitre.org
References
- http://securityreason.com/securityalert/4060
- http://www.securityfocus.com/bid/30365Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43987
- https://www.exploit-db.com/exploits/6127
- http://securityreason.com/securityalert/4060
- http://www.securityfocus.com/bid/30365Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43987
- https://www.exploit-db.com/exploits/6127
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.