what you don't know can hurt you

WordPress Neosense Theme 1.7 Shell Upload

WordPress Neosense Theme 1.7 Shell Upload
Posted Sep 19, 2016
Authored by Walter Hop

WordPress Neosense theme version 1.7 suffers from a remote shell upload vulnerability.

tags | advisory, remote, shell
MD5 | f2ba5d09e06ff571c9fdd1a1f2317297

WordPress Neosense Theme 1.7 Shell Upload

Change Mirror Download
Unrestricted Upload/RCE in Neosense theme for WordPress
https://lifeforms.nl/20160919/unrestricted-upload-neosense <https://lifeforms.nl/20160919/unrestricted-upload-neosense>

Vulnerability:

Neosense is a WordPress theme by dynamicpress. (https://themeforest.net/item/neosense-multipurpose-wordpress-theme/6363229 <https://themeforest.net/item/neosense-multipurpose-wordpress-theme/6363229>)

Neosense theme version 1.7 contains an unrestricted file upload vulnerability.

Version 1.7 (and possibly earlier) includes in its theme directory a copy of the "qquploader" ajax file uploader, which does not verify user authorization. Using this uploader, an attacker can upload any file to the site. The uploaded file is placed in the wp-content/uploads/YYYY/mm directory, which is normally writable.

The vulnerability can be used to achieve remote code execution by uploading a PHP script with extension .php or .phtml.

Fix:
The vulnerability was fixed in Neosense theme 1.8 by switching to WordPress core functions for file uploads.

Timeline:
- 12 Aug: Vulnerability submitted to dynamicpress
- 16 Aug: Response by dynamicpress
- 29 Aug: Neosense theme 1.8 released by dynamicpress
- 19 Sep: Vulnerability published

Credits:
The vulnerability was found by Walter Hop, Slik BV, The Netherlands.

--
Walter Hop | PGP key: https://lifeforms.nl/pgp



Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    60 Files
  • 2
    Apr 2nd
    20 Files
  • 3
    Apr 3rd
    15 Files
  • 4
    Apr 4th
    5 Files
  • 5
    Apr 5th
    5 Files
  • 6
    Apr 6th
    27 Files
  • 7
    Apr 7th
    31 Files
  • 8
    Apr 8th
    18 Files
  • 9
    Apr 9th
    0 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    0 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close