PT-2024-10575 · Unknown · Frontend File Manager+1

Ethicalhack3R · Published 2024-10-16 · Updated 2024-10-30 · CVE-2016-15042

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frontend File Manager versions prior to 4.0 N-Media Post Front-end Form versions prior to 1.1

Description The issue allows unauthenticated attackers to upload arbitrary files on the server due to missing file type validation via the nm filemanager upload file and nm postfront upload file AJAX actions, potentially making remote code execution possible.

Recommendations For Frontend File Manager versions prior to 4.0, update to version 4.0 or later to resolve the issue. For N-Media Post Front-end Form versions prior to 1.1, update to version 1.1 or later to resolve the issue. As a temporary workaround, consider disabling the nm filemanager upload file and nm postfront upload file AJAX actions until a patch is available.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2016-15042

Affected Products

Frontend File Manager

N-Media Post Front-End Form

References · 8

• 🔥 https://pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-front-end-file-upload-and-manager-plugin · Exploit
• 🔥 https://pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-n-media-post-front-end-form · Exploit
• https://osv.dev/vulnerability/CVE-2016-15042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-15042 · Security Note
• https://wpscan.com/vulnerability/052f7d9a-aaff-4fb1-92b7-aeb83cc705a7 · Note
• https://acunetix.com/vulnerabilities/web/wordpress-plugin-n-media-post-front-end-form-arbitrary-file-upload-1-0 · Note
• https://wordpress.org/plugins/nmedia-user-file-uploader/#developers · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2c1e6298-f243-49a5-b1b7-52bd6a6c8858?source=cve · Note