Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload
Vulnerability Description
The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter.
CVSS Information
N/A
Vulnerability Type
危险类型文件的不加限制上传
Vulnerability Title
Automattic WooCommerce 代码问题漏洞
Vulnerability Description
Automattic WooCommerce是美国Automattic公司的一套基于WordPress的开源电子商务平台。 WooCommerce Upload Files WordPress plugin before 59.4 存在安全漏洞，攻击者可利用该漏洞路径遍历将文件上传到不同的位置。
CVSS Information
N/A
Vulnerability Type
N/A