|
Description
|
|
Sammy Forgit has discovered a vulnerability in the Famous and Deep Blue themes for WordPress, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the wp-content/themes/famous/megaframe/megapanel/inc/upload.php and wp-content/themes/deep-blue/megaframe/megapanel/inc/upload.php scripts allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
The vulnerability is confirmed in Famous theme version 2.0.5 and Deep Blue theme version 1.9.2. Other versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
WordPress Deep Blue Theme 1.xWordPress Famous Theme 2.x
|
|
|
|
|
|
Solution
|
|
Restrict access to the wp-content/themes/famous/megaframe/megapanel/inc/upload.php or wp-content/themes/deep-blue/megaframe/megapanel/inc/upload.php script (e.g. via .htaccess).
|
|
|
|
|
|
CVE
|
|
|
|
|
|
|
|
References
|
|
OpenSysCom:
http://www.opensyscom.fr/Actualites/wordpress-themes-famous-arbitrary-file-upload-vulnerability.html
http://www.opensyscom.fr/Actualites/wordpress-themes-deep-blue-arbitrary-file-upload-vulnerability.html
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
