Dangerous File Type Upload (.phar/.svg) in Drag and Drop Multiple File Upload for Contact Form 7

Skrevet den af i Drag and Drop Multiple File Upload for CF7

The plugin’s unauthenticated upload handler does not block .phar and .svg files. An attacker can upload a .phar file, which leads to remote code execution on servers that execute .phar as PHP, or an .svg file carrying stored cross-site scripting.

This vulnerability affects the following application versions:

  • Drag and Drop Multiple File Upload for CF7 1.3.3.3.1
  • Drag and Drop Multiple File Upload for CF7 1.3.3.3.2
  • Drag and Drop Multiple File Upload for CF7 1.3.4
  • Drag and Drop Multiple File Upload for CF7 1.3.5
  • Drag and Drop Multiple File Upload for CF7 1.3.5.1
  • Drag and Drop Multiple File Upload for CF7 1.3.5.4
  • Drag and Drop Multiple File Upload for CF7 1.3.5.5.1
  • Drag and Drop Multiple File Upload for CF7 1.3.5.7
  • Drag and Drop Multiple File Upload for CF7 1.3.5.8
  • Drag and Drop Multiple File Upload for CF7 1.3.5.9
  • Drag and Drop Multiple File Upload for CF7 1.3.6.1
  • Drag and Drop Multiple File Upload for CF7 1.3.6.2
  • Drag and Drop Multiple File Upload for CF7 1.3.6.3
  • Drag and Drop Multiple File Upload for CF7 1.3.6.4
  • Drag and Drop Multiple File Upload for CF7 1.3.6.5
  • Drag and Drop Multiple File Upload for CF7 1.3.6.6
  • Drag and Drop Multiple File Upload for CF7 1.3.6.7
  • Drag and Drop Multiple File Upload for CF7 1.3.6.8
  • Drag and Drop Multiple File Upload for CF7 1.3.6.9
  • Drag and Drop Multiple File Upload for CF7 1.3.7.1
  • Drag and Drop Multiple File Upload for CF7 1.3.7.2
  • Drag and Drop Multiple File Upload for CF7 1.3.7.3
  • Drag and Drop Multiple File Upload for CF7 1.3.7.4
  • Drag and Drop Multiple File Upload for CF7 1.3.7.5
  • Drag and Drop Multiple File Upload for CF7 1.3.7.6
  • Drag and Drop Multiple File Upload for CF7 1.3.7.7
  • Drag and Drop Multiple File Upload for CF7 1.3.7.8
  • Drag and Drop Multiple File Upload for CF7 1.3.7.9
  • Drag and Drop Multiple File Upload for CF7 1.3.8.0
  • Drag and Drop Multiple File Upload for CF7 1.3.8.1
  • Drag and Drop Multiple File Upload for CF7 1.3.8.2
  • Drag and Drop Multiple File Upload for CF7 1.3.8.3
  • Drag and Drop Multiple File Upload for CF7 1.3.8.4
  • Drag and Drop Multiple File Upload for CF7 1.3.8.5
  • Drag and Drop Multiple File Upload for CF7 1.3.8.6
  • Drag and Drop Multiple File Upload for CF7 1.3.8.7
  • Drag and Drop Multiple File Upload for CF7 1.3.8.8
  • Drag and Drop Multiple File Upload for CF7 1.3.8.9
  • Drag and Drop Multiple File Upload for CF7 1.3.9.0
  • Drag and Drop Multiple File Upload for CF7 1.3.9.1
  • Drag and Drop Multiple File Upload for CF7 1.3.9.2