CVE-2020-24186
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
85Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 10epss 95%
da publicação à arma287 dias
Publicada no NVD24 de ago.
1ª PoC+287d
metasploit21 de fev.
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
Produtos afetados
n/a · n/aPoCs públicas encontradas — 13
exploitdbwww.exploit-db.com/exploits/49967não verificadoexploitdbwww.exploit-db.com/exploits/49962não verificadogithubgithub.com/hev0x/CVE-2020-24186-wpDiscuz-7.0.4-RCE★ 19githubgithub.com/substing/CVE-2020-24186_reverse_shell_upload★ 14githubgithub.com/Sakura-501/CVE-2020-24186-exploit★ 3githubgithub.com/wvverez/CVE-2020-24186★ 1githubgithub.com/GazettEl/CVE-2020-24186★ 0githubgithub.com/meicookies/CVE-2020-24186★ 0githubgithub.com/kiyingiericmark-wq/CVE-2020-24186★ 0githubgithub.com/sec-dojo-com/CVE-2020-24186★ 0cve_referencepacketstormsecurity.com/files/162983/WordPress-wpDiscuz-7.0.4-Shell-Upload.htmlnão verificadocve_referencepacketstormsecurity.com/files/163302/WordPress-wpDiscuz-7.0.4-Shell-Upload.htmlnão verificadocve_referencepacketstormsecurity.com/files/163012/WordPress-wpDiscuz-7.0.4-Remote-Code-Execution.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/162983/WordPress-wpDiscuz-7.0.4-Shell-Upload.htmlhttp://packetstormsecurity.com/files/163012/WordPress-wpDiscuz-7.0.4-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/163302/WordPress-wpDiscuz-7.0.4-Shell-Upload.htmlhttps://www.wordfence.com/blog/2020/07/critical-arbitrary-file-upload-vulnerability-patched-in-wpdiscuz-plugin/