|
WordPress Custom Field PHP Script Upload
|
|
|
|
|
Secunia Advisory:
|
SA25794
|
|
|
Release Date:
|
2007-06-26
|
|
Last Update:
|
2007-07-11
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Security Bypass
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | WordPress 2.x
WordPress MU 1.x
|
| | CVE reference: | CVE-2007-3543 (Secunia mirror)
CVE-2007-3544 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Alexander Concha has discovered a vulnerability in WordPress and WordPress MU, which can be exploited by malicious users to bypass certain security restrictions and to compromise a vulnerable system.
The vulnerability is caused due to improper authentication verification. This can be exploited to add the custom field "_wp_attached_file" to a post, upload a PHP script to an arbitrary path with wp-app.php or app.php, and execute arbitrary PHP code.
Successful exploitation requires valid Editor credentials and that the system is configured to allow uploads.
The vulnerability is confirmed in WordPress 2.2 and reported in WordPress MU 1.2.2. Prior versions may also be affected.
Solution:
Update to WordPress 2.2.1 or WordPress MU 1.2.3.
Provided and/or discovered by:
Alexander Concha
Changelog:
2007-07-11: Added CVE reference.
Original Advisory:
http://www.buayacorp.com/files/wordpress/wordpress-advisory.html
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
30 Related Secunia Security Advisories, displaying 10
|
|
|
1. WordPress PHP Code Execution and Cross-Site Scripting
|
|
2. WordPress "cat" Directory Traversal Vulnerability
|
|
3. WordPress XML-RPC Post Edit Vulnerability
|
|
4. WordPress MU File Upload and Security Bypass
|
|
5. WordPress Multiple Information Disclosure Vulnerabilities
|
|
6. WordPress GBK/Big5 Character Set "s" SQL Injection
|
|
7. WordPress Cookies Security Bypass Weakness
|
|
8. WordPress "posts_columns" Cross-Site Scripting
|
|
9. WordPress Multiple Vulnerabilities
|
|
10. WordPress "style" Cross-Site Scripting
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
