‫ WordPress Evarisk Plugin Arbitrary File Upload Vulnerability

IRCAD2012061990
ID: IRCAD2012061990
Release Date: 2012-06-14
Criticality level: Highly critical
Software:
WordPress Evarisk Plugin 5.x
Description:
Sammy Forgit has discovered a vulnerability in the Evarisk plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the wp-content/plugins/evarisk/include/lib/actionsCorrectives/activite/uploadPhotoApres.php script allowing to upload files to a folder inside the webroot. This can be exploited to e.g. execute arbitrary PHP code by uploading a malicious PHP script.
The vulnerability is confirmed in version 5.1.5.4. Other versions may also be affected.
Solution
Restrict access to the wp-content/plugins/evarisk/include/lib/actionsCorrectives/activite folder (e.g. via .htaccess).
References:
Secunia:
 

نظرات

بدون نظر
شما برای نظر دادن باید وارد شوید

نوشته

 
تاریخ ایجاد: 26 خرداد 1391

امتیاز

امتیاز شما
تعداد امتیازها:0