Arbitrary file upload in Creative-Solutions Creative Contact Form
CVE-2014-8739
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
Vulnerability class: Unrestricted File Upload
EPSS: 0.917 (99.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Creative-solutions Creative_contact_form
- Jquery_file_upload_project Jquery_file_upload — versions 6.4.4
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC, Broken Link)
- cve@mitre.org (x_refsource_MISC, Broken Link)
Frequently asked questions
- What is CVE-2014-8739?
- CVE-2014-8739 is a critical-severity vulnerability in Creative-Solutions Creative Contact Form, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.8/10. Published 2020-02-08.
- How severe is CVE-2014-8739?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2014-8739 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.