WordPress Flip Book Plugin Arbitrary File Upload Vulnerability


Description   Sammy Forgit has reported a vulnerability in the Flip Book plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the wp-content/plugins/flipbook/php.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
The vulnerability is reported in version 1.0. Other versions may also be affected.
     
Vulnerable Products   Vulnerable Software:
WordPress Flip Book Plugin 1.x
     
Solution   No official solution is currently available.
     
CVE  
     
References   http://www.opensyscom.fr/Actualites/wordpress-plugins-flip-book-arbitrary-file-upload-vulnerability.html
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
Upload of a PHP file in a vulnerable web application
5.0.0
     


 
 
 
 
 Risk level 
High 

 Vulnerability First Public Report Date 
2012-07-09 

 Target Type 
Server 

 Possible exploit 
Remote