HackDig : Dig high-quality web security articles for hacker

Unrestricted Upload/RCE in Neosense theme for WordPress

2016-09-19 20:25
Unrestricted Upload/RCE in Neosense theme for WordPress
https://lifeforms.nl/20160919/unrestricted-upload-neosense <https://lifeforms.nl/20160919/unrestricted-upload-neosense>

Vulnerability:

Neosense is a WordPress theme by dynamicpress.
(https://themeforest.net/item/neosense-multipurpose-wordpress-theme/6363229
<https://themeforest.net/item/neosense-multipurpose-wordpress-theme/6363229>)

Neosense theme version 1.7 contains an unrestricted file upload vulnerability.

Version 1.7 (and possibly earlier) includes in its theme directory a copy of the "qquploader" ajax file uploader, which
does not verify user authorization. Using this uploader, an attacker can upload any file to the site. The uploaded file
is placed in the wp-content/uploads/YYYY/mm directory, which is normally writable.

The vulnerability can be used to achieve remote code execution by uploading a PHP script with extension .php or .phtml.

Fix:
The vulnerability was fixed in Neosense theme 1.8 by switching to WordPress core functions for file uploads.

Timeline:
- 12 Aug: Vulnerability submitted to dynamicpress
- 16 Aug: Response by dynamicpress
- 29 Aug: Neosense theme 1.8 released by dynamicpress
- 19 Sep: Vulnerability published

Credits:
The vulnerability was found by Walter Hop, Slik BV, The Netherlands.

--
Walter Hop | PGP key: https://lifeforms.nl/pgp


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


Source: 84/peS/6102/erusolcsidlluf/gro.stsilces

Read:2101 | Comments:0 | Tags:No Tag

“Unrestricted Upload/RCE in Neosense theme for WordPress”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud

Keywords