CVE-2023-4634

Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

CVSS 9.8 CRITICALEPSS 82.6%CWE-73

The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

dglingren · Media Library Assistant

public PoCs found — 4

githubgithub.com/Patrowl/CVE-2023-4634★ 47 githubgithub.com/Evillm/CVE-2023-4634-PoC★ 0 cve_referencepacketstormsecurity.com/files/174508/wpmla309-lfiexec.tgzunverified exploitdbwww.exploit-db.com/exploits/51737unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/Patrowl/CVE-2023-4634/https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2955933%40media-library-assistant&new=2955933%40media-library-assistant&sfp_email=&sfph_mail=#file4 https://www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=cve