← Advisories

WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Creation Exploit (RCE)

High

Advisory ID

ZSL-2015-5242

Release Date

14 April 2015

Vendor

Miwisoft LLC - http://www.miwisoft.com

Affected Version

1.0.5

CVE

N/A

Tested On

Apache 2.4.10 (Win32), PHP 5.6.3, MySQL 5.6.21

Summary

MiwoFTP is a smart, fast and lightweight file manager plugin that operates from the back-end of WordPress.

Description

MiwoFTP WP Plugin suffers from a cross-site request forgery remote code execution vulnerability. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions like executing arbitrary PHP code by uploading a malicious PHP script file, with administrative privileges, if a logged-in user visits a malicious web site.

Proof of Concept

miwoftp_rce.txtTXT

Disclosure Timeline

24.03.2015Vulnerability discovered.

25.03.2015Vendor contacted.

25.03.2015Vendor responds asking more details.

26.03.2015Sent details to the vendor.

27.03.2015Vendor forwarded details to developers.

30.03.2015Vendor confirms vulnerability scheduling patch by end of week.

31.03.2015Replied to the vendor.

09.04.2015Asked vendor for status update.

12.04.2015No reply from the vendor.