CVE-2014-9521: Code Injection
Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the uploads directory, as demonstrated by the .php.swp filename.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9521?
CVE-2014-9521 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2014-9521?
To fix CVE-2014-9521, upgrade InfiniteWP Admin Panel to version 2.4.4 or later.
What type of attack is associated with CVE-2014-9521?
CVE-2014-9521 is associated with file upload attacks that allow remote attackers to execute arbitrary code.
Which versions of InfiniteWP are affected by CVE-2014-9521?
CVE-2014-9521 affects InfiniteWP Admin Panel versions prior to 2.4.4.
What is the primary vulnerability mechanism in CVE-2014-9521?
The primary mechanism of CVE-2014-9521 is the unrestricted file upload which allows files with double extensions to be uploaded.