critical9.8Public exploit code
CVE-2018-9206
Unrestricted Upload of File with Dangerous Type in blueimp-file-upload
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- blueimp's jQuery 9.22.0 - (Arbitrary) File Upload (Metasploit)2018-11-06 · remote · php · Verified
- jQuery-File-Upload 9.22.0 - Arbitrary File Upload2018-10-11 · webapps · php · Verified
- Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit2019-01-16 · webapps · php
Impact
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | blueimp-file-upload | <= 9.22.0 | 9.22.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jquery File Upload Project | Jquery File Upload | through 9.22.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.securityfocus.com/bid/105679
- http://www.securityfocus.com/bid/106629
- http://www.vapidlabs.com/advisory.php?v=204
- https://wpvulndb.com/vulnerabilities/9136
- https://www.exploit-db.com/exploits/45790/
- https://www.exploit-db.com/exploits/46182/
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://github.com/psolom/RichFilemanager/issues/354
- https://github.com/psolom/RichFilemanager/issues/412
- https://github.com/advisories/GHSA-4cj8-g9cp-v5wr
- https://nvd.nist.gov/vuln/detail/CVE-2018-9206