CVE Vulnerability

CVE-2019-11185

The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://wpvulndb.com/vulnerabilities/9320 Exploit Third Party Advisory
https://wp-livechat.com/ Vendor Advisory
https://wordpress.org/plugins/wp-live-chat-support/#developers Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:wp-livechat:wp_live_chat_support_pro:*:*:*:*:*:wordpress:*:*
Information

Published : 2019-06-03 09:29

Updated : 2019-06-04 08:42

NVD link : CVE-2019-11185

Mitre link : CVE-2019-11185

Products Affected

3cx

Live Chat

CWE
CWE-434