‫ WordPress Top Quark Architecture Plugin Arbitrary File Upload Vulnerability

IRCNE2012061969
 
 
ID: IRCNE2012061969
Release Date: 2012-06-11
Criticality level: Highly critical
 
Software:
WordPress Top Quark Architecture Plugin 2.x
 
Description:
A vulnerability has been discovered in the Top Quark Architecture plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the wp-content/plugins/topquark/lib/js/fancyupload/showcase/batch/script.php script allowing the upload of arbitrary files to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.

The vulnerability is confirmed in version 2.1.0. Other versions may also be affected.
 
Solution
Restrict access to the wp-content/plugins/topquark/lib/js/fancyupload/showcase/batch/script.php script (e.g. via .htaccess).
 
References:
 
Secunia:
 

نظرات

بدون نظر
شما برای نظر دادن باید وارد شوید

نوشته

 
تاریخ ایجاد: 23 خرداد 1391

امتیاز

امتیاز شما
تعداد امتیازها:0