CVE-2008-3362

published 2008-07-30

CVE-2008-3362: Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute…

Priority P2 70 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct request to the file in wp-content/plugins/downloads-manager/upload/.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
giulio_ganci	wp_downloads_manager	—	—
wordpress	wp_downloads_manager	—	—

Detection & IOCs extracted from sources · hover to see the quote

path wp-content/plugins/downloads-manager/upload/↗

path upload.php↗

• → Monitor for file uploads with executable extensions via the 'upfile' POST parameter to upload.php in the Downloads Manager plugin path. ↗
• → Alert on direct HTTP GET requests to files placed under wp-content/plugins/downloads-manager/upload/, especially files with executable extensions (e.g., .php, .php5, .phtml). ↗

• · Vulnerability is specific to version 0.2 of the Wp Downloads Manager plugin; later versions may not be affected. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20