Make Connector’s REST media upload handler copied the uploaded file into the uploads directory under its client-supplied name before checking the file type, so a rejected file such as a .php script was already on disk when the error was returned. An attacker holding the plugin’s API key (Administrator-level access) could upload and then execute arbitrary PHP on the server. Affects versions up to and including 1.5.10; fixed in 1.6.0.
This vulnerability affects the following application versions:
- Make Connector 1.5
- Make Connector 1.5.1
- Make Connector 1.5.2
- Make Connector 1.5.3
- Make Connector 1.5.4
- Make Connector 1.5.5
- Make Connector 1.5.6
- Make Connector 1.5.7
- Make Connector 1.5.8
- Make Connector 1.5.9
- Make Connector 1.5.10