.. / CVE-2020-35489

• File Upload
• Nuclei
• Web

Exploit for WordPress Contact Form 7 - Unrestricted File Upload (CVE-2020-35489)

Description:

WordPress Contact Form 7 before 5.3.2 allows unrestricted file upload and remote code execution because a filename may contain special characters.

Nuclei Template

View the template here CVE-2020-35489.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-35489.yaml

References: