|
Description
|
|
A vulnerability has been discovered in the WP-Property plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the wp-content/plugins/wp-property/third-party/uploadify/uploadify.php script allowing to upload files with arbitrary extensions to a folder inside the webroot. This can be exploited to e.g. execute arbitrary PHP code by uploading a malicious PHP script.
The vulnerability is confirmed in version 1.35.0. Prior versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
WordPress WP-Property Plugin 1.x
|
|
|
|
|
|
Solution
|
|
Update to version 1.35.1 or later.
|
|
|
|
|
|
CVE
|
|
|
|
|
|
|
|
References
|
|
WP-Property:
http://wordpress.org/plugins/wp-property/changelog/
Sammy FORGIT:
http://packetstormsecurity.org/files/113274/WordPress-WP-Property-1.35.0-Shell-Upload.html
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
