CVE-2020-35951 PoC — WordPress Quiz and Survey Master plugin 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35951.yaml

Associated Vulnerability

Title:WordPress Quiz and Survey Master plugin 安全漏洞 (CVE-2020-35951)
Description:WordPress是WordPress（Wordpress）基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 Quiz and Survey Master plugin before 7.0.1 for WordPress 存在安全漏洞，该漏洞允许用户删除任意文件，如wp-config.php文件，这可以有效地使站点脱机，并允许攻击者可利用该漏洞在他们的控制下重新安装WordPress实例。

Description

Wordpress Quiz and Survey Master <7.0.1 allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).

File Snapshot


 id: CVE-2020-35951

info:
  name: Wordpress Quiz and Survey Master <7.0.1 - Arbitrary File Deletion


...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!