wordpress/wp-content/plugins/wp-symposium/server/php/uploadhandler.php File arbitrary Upload Vul

Catalog

1 . Vulnerability Description 2 . Vulnerability trigger Condition 3 . Vulnerability Impact Range 4 . Vulnerability Code Analysis 5 . Defense Methods 6. Defensive thinking

1. Vulnerability description

Relevant Link:
2. Vulnerability Trigger Condition
3. Vulnerability Impact Range
4. Vulnerability Code Analysis

/wp-content/plugins/wp-symposium/server/php/uploadhandler.php

function __construct ($options =NULL, $initialize =true, $error _messages =NULL) {     if(Isset ($_post['Uploader_uid']) && Isset ($_post['Uploader_url']) {$upload _dir= $_post['Uploader_dir']; $upload _url= $_post['Uploader_url']; $ This->options =Array ('Script_url'= = $ This->get_full_url ().'/',        'Upload_dir'=$upload _dir,'Upload_url'=$upload _url,'User_dirs'=false,        'Mkdir_mode'=0755,        'Param_name'='Files',        //Set The following option to ' POST ', if your server does not support//DELETE requests. This was a parameter sent to the client:        'Delete_type'='DELETE',        'Access_control_allow_origin'='*',        'access_control_allow_credentials'=false,        'Access_control_allow_methods'=Array ('OPTIONS',            'HEAD',            'GET',            'POST',            'PUT',            'PATCH',            'DELETE'        ),        'access_control_allow_headers'=Array ('Content-type',        'Content-range',        'content-disposition'        ),        //Enable to provide file downloads via GET requests to the PHP script:        'download_via_php'=false,        //defines which files can be displayed the inline when downloaded:        'Inline_file_types'='/\. (mp4|zip|doc|docx|ppt|pptx|xls|xlsx|txt|pdf|gif|jpe?g|png) $/i',        //allow arbitrary suffix file uploads, which is the source of the vulnerability        'Accept_file_types'='/.+$/i',        ..

5. Defense Methods

/wp-content/plugins/wp-symposium/server/php/uploadhandler.php

..//Enable to provide file downloads via GET requests to the PHP script:'download_via_php'=false,//defines which files can be displayed the inline when downloaded:'Inline_file_types'='/\. (mp4|zip|doc|docx|ppt|pptx|xls|xlsx|txt|pdf|gif|jpe?g|png) $/i',/**/'Accept_file_types'='/. (mp4|doc|docx|ppt|pptx|xls|xlsx|txt|pdf|gif|jpe?g|png) $/i', /**/..

6. Defensive Thinking

Copyright (c) Littlehann All rights reserved

wordpress/wp-content/plugins/wp-symposium/server/php/uploadhandler.php File arbitrary Upload Vul