Description
Wordpress插件的3dprint-lite 的AJAX操作没有任何授权，也不会检查上传的文件，允许未经身份验证的用户将任意文件上传到web服务器。不过有一个.htaccess，阻止在Apache等Web服务器上访问该文件，因此该漏洞的的利用存在一定的限制
Wordpress 3dprint-lite admin-ajax.php 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://wpscan.com/vulnerability/c46ecd0d-a132-4ad6-b936-8acde3a09282/
https://www.exploit-db.com/exploits/50321
https://nvd.nist.gov/vuln/detail/CVE-2021-4436
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/3dprint-lite/3dprint-lite-1915-arbitrary-file-upload
https://www.invicti.com/web-application-vulnerabilities/wordpress-plugin-3dprint-lite-arbitrary-file-upload-1-9-1-4
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-3dprint-lite-arbitrary-file-upload-1-9-1-4/
https://github.com/projectdiscovery/nuclei-templates/issues/5325
https://thedfirreport.com/wp-content/uploads/2024/03/WordPress-Plugin-Exploit-Leads-to-Godzilla-Web-Shell-Discovery-New-CVE.pdf.pdf
https://soc.cyber.wa.gov.au/advisories/20240311003-WordPress-Plugin-3Dprint-Lite-Critical-Vulnerability-/