|
Description
|
|
DigiP has reported a vulnerability in the Clockstone theme for WordPress, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the wp-content/themes/clockstone/theme/functions/upload.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
The vulnerability is reported in versions 1.2 and prior.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
WordPress Clockstone Theme 1.x
|
|
|
|
|
|
Solution
|
|
Reportedly fixed by the vendor (please contact the vendor for details).
|
|
|
|
|
|
CVE
|
|
|
|
|
|
|
|
References
|
|
http://www.attack-scanner.com/security/clockstone-and-other-various-cmsmasters-themes-flaw-patched/
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
