← back
CVE-2014-2223

CVE-2014-2223

EPSS 10.0%
Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file, then accessing the PHP file via a direct request to it in plog-content/uploads/archive/.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/128029/Plogger-Authenticated-Arbitrary-File-Upload.htmlunverifiedcve_referencewww.exploit-db.com/exploits/34447unverifiedexploitdbwww.exploit-db.com/exploits/34447unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/128029/Plogger-Authenticated-Arbitrary-File-Upload.htmlhttp://seclists.org/oss-sec/2014/q1/443http://seclists.org/oss-sec/2014/q1/446https://www.sysdream.com/CVE-2014-2223_CVE-2014-2224https://www.sysdream.com/system/files/PLOGGER-1.0RC1-advisory.pdfhttp://www.exploit-db.com/exploits/34447