WordPress.org
Get WordPress

Make WordPress Core

Opened 6 years ago

Closed 10 months ago

Last modified 9 months ago

#49725 closed defect (bug) (fixed)

Bug in plugin upload

Reported by: offensive's profile offensive Owned by:
Milestone: 6.4.3 Priority: normal
Severity: normal Version:
Component: Upload Keywords:
Focuses: administration Cc:

Description

bug in wordpress version 5.3.2

how to exploit:

  1. download wordpress and run into localhost.
  2. trying to upload plugin than they are showing here only upload .zip file.
  3. but we are trying to upload .php shell file.
  4. now see file is upload successfully in database.

Attachments (4)

2020-03-21 13_23_09-Microsoft Game DVR - Dashboard ‹ reconforce — WordPress.png​ (225.3 KB) - added by offensive 6 years ago.
2020-03-21 13_22_09-.png​ (55.6 KB) - added by offensive 6 years ago.
2020-03-21 13_22_09-.2.png​ (55.6 KB) - added by offensive 6 years ago.
upload-non-zip-error.png​ (31.2 KB) - added by mindctrl 10 months ago.
Error message demonstrating that non-zip files are not allowed.

Download all attachments as: .zip

Change History (9)

@offensive
6 years ago

@offensive
6 years ago

@offensive
6 years ago

#1 @mukesh27
6 years ago

  • Keywords dev-feedback added
  • Severity changed from critical to normal
  • Summary changed from found a bug in wordpress version 5.3.2 to Bug in plugin upload
  • Version 5.3.2 deleted

Hi @offensive,

Welcome to WordPress Trac! Thanks for the ticket.

When I try to upload PHP file in plugin upload it shows me below error and uploaded file is move-in upload directory.

Installing Plugin from uploaded file: code.php
Unpacking the package…

The package could not be installed. PCLZIP_ERR_BAD_FORMAT (-10) : Unable to find End of Central Dir Record signature

Before moving the file in the upload folder system need to check it uploaded file has valid format than and then move the file in the upload directory

#2 @roytanck
6 years ago

Just did a quick test using Local by Flywheel. I got the same error as @mukesh27, and the plugin file was not present in my /wp-content/plugins folder.

The file was available under /wp-content/uploads/2020/03 .

#3 @callumbw95
12 months ago

  • Keywords close added; dev-feedback removed

Hi All,
This doesn't appear to be an issue in the latest releases, and you cannot upload a single php file now. There is validation on the file upload input to only accept .zip files. However if you avoid that, and upload a php file regardless there is validation server side to stop the file from being read or stored within the site.
As of such I believe this ticket no longer applies to the current state of WordPress and can be closed.

@mindctrl
10 months ago

Error message demonstrating that non-zip files are not allowed.

#4 @mindctrl
10 months ago

  • Keywords close removed
  • Resolution set to invalid
  • Status changed from new to closed

Hi all, I've confirmed this is no longer an issue in the latest version of WP. As such, I'm going to close this ticket to help clean up Trac. If you think this is still a problem and can provide instructions on how to reproduce, please feel free to reopen.

#5 @peterwilsoncc
9 months ago

  • Milestone changed from Awaiting Review to 6.4.3
  • Resolution changed from invalid to fixed

This was resolved in r57388 so I've changed the status to fixed, see ​https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r

Note: See TracTickets for help on using tickets.