cve/2015/CVE-2015-4133.md

CVE-2015-4133

Description

Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.

POC

Reference

• http://packetstormsecurity.com/files/130845/
• http://packetstormsecurity.com/files/131515/
• https://wpvulndb.com/vulnerabilities/7867
• https://www.exploit-db.com/exploits/36809/

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Afetter618/WordPress-PenTest
• https://github.com/VTFoundation/vulnerablewp
• https://github.com/cflor510/Wordpress-
• https://github.com/waleedzafar68/vulnerablewp