选择风格

WordPress Front End Upload v0.5.4.4任意php文件上传

时间：2013/4/19 12:09:00 作者：平凡之路　来源：xuhantao.com 浏览：

标题: WordPress Front End Upload v0.5.4.4 Arbitrary PHP File Upload Vulnerability
作者: Chris Kellum
主页:
软件地址:
影响版本: 0.5.4.4

缺陷分析
=====================

Plugin does not properly filter filetypes, which allows for the upload of filetypes in the following format:

filename.php.jpg

Vulnerable hosts will serve such files as a php file, allowing for malicious files to be uploaded and executed.

In creating the uploads folder for this plugin, the code utilizes uniqid to add a unique string to the upload folder name in order to better hide it from direct access.

Example:

/wp-content/uploads/feu_9fc12558ac71e6995808cfc590207e87/

However, many WordPress installations allow direct access to the /wp-content/uploads/ folder, so simply look for a folder name beginning with 'feu_' to locate your upload.
，涛涛电脑知识网，涛涛电脑知识网

分享到： QQ空间腾讯微博新浪微博人人网百度贴吧

上一篇：MySQL Session Hijacking over RFI

下一篇：层层揭开WEB安全问题