Description
WordPress的Kish Guest Posting插件1.2之前版本中的uploadify/scripts/uploadify.php中存在任意文件上传漏洞，该漏洞源于应用程序对用户提供的输入未经充分过滤。攻击者可利用该漏洞上传任意文件到受影响的计算机，这将导致在受影响的应用程序上下文中执行任意代码。
WordPress ‘Kish Guest Posting’ 插件 ‘uploadify.php’ 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.exploit-db.com/exploits/18412
https://nvd.nist.gov/vuln/detail/CVE-2012-5318
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-kish-guest-posting-uploadify-php-arbitrary-file-upload-1-2/
https://karmainsecurity.com/vuln-78
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kish-guest-posting/kish-guest-posting-12-unauthenticated-arbitrary-file-upload
https://www.cvedetails.com/cve/CVE-2012-1125/
https://www.invicti.com/web-application-vulnerabilities/wordpress-plugin-kish-guest-posting-uploadify-php-arbitrary-file-upload-1-2
https://seclists.org/oss-sec/2012/q1/571
https://access.redhat.com/security/cve/cve-2012-5318