PT-2013-5887 · Dropbox · Simple Dropbox Upload

Hiphopsmurf · Published 2013-09-30 · Updated 2017-08-29 · CVE-2013-5963

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Dropbox Upload plugin versions prior to 1.8.8.1

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the wp-content/uploads/wpdb/ directory via the multi.php file in the Simple Dropbox Upload plugin, and then accessing it directly.

Recommendations For versions prior to 1.8.8.1, update to version 1.8.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp-content/uploads/wpdb/ directory to minimize the risk of exploitation. Avoid using the multi.php file in the Simple Dropbox Upload plugin until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2013-5963

Affected Products

Simple Dropbox Upload

References · 7

• 🔥 http://packetstormsecurity.com/files/123235 · Exploit
• 🔥 http://wordpress.org/plugins/simple-dropbox-upload-form/changelog · Exploit
• http://secunia.com/advisories/54856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5963 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/87166 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5963 · Note
• http://plugins.trac.wordpress.org/changeset?reponame=&old=774214%40simple-dropbox-upload-form%2Ftrunk&new=774214%40simple-dropbox-upload-form%2Ftrunk · Note