Login

Old Vulnerability Report

4 Oct 2016

Old Vulnerability Report: Arbitrary File Upload Vulnerability in 360 Product Rotation

One of the things that we do to provide our customers with the best data on WordPress plugin vulnerabilities is to monitor third party data on hacking attempts. That sometimes leads us to finding what looks to be exploitation of vulnerabilities that a hacker has just discovered in the current version of a plugin. In other cases it shows old vulnerabilities that hackers are still trying to exploit. We recently spotted an attempt to exploit an arbitrary file upload vulnerability in older versions of the plugin 360 Product Rotation. We couldn’t find a page that describes the issue to link to for our data on the vulnerability, so here are the details.

The hacking attempt involved a request sent to the page /includes/plugin-media-upload.php. Through that file you upload a .zip file and the contents are extracted and saved in a directory on the website. [Read more]

11 Jul 2016

Old Vulnerability Report: Arbitrary File Upload Vulnerability in PitchPrint

One of the things that we recently started doing to better keep track of the  plugin vulnerabilities out there is to monitor third party data on hacking attempts. That sometimes leads us to finding what looks to be exploitation of vulnerabilities that a hacker has just discovered in the current version of a plugin. In other cases it shows old vulnerabilities that hackers are still trying to exploit. We have recently spotted an attempt to exploit an arbitrary file upload vulnerability in older versions of the plugin PitchPrint. We couldn’t find a page that clearly described the issue to link to for our data on the vulnerability, so here are the details.

The hacking attempt involved a request sent to the page /wp-content/plugins/pitchprint/uploader/, which would cause the file at /wp-content/plugins/pitchprint/uploader/index.php to be loaded. That will then cause the file /wp-content/plugins/pitchprint/uploader/UploadHandler.php to be loaded and allow a file to be uploaded: [Read more]

22 Jun 2016

Old Vulnerability Report: Arbitrary File Viewing Vulnerability in Cherry Plugin

One of the things that we do to keep track of the  plugin vulnerabilities out there is to monitor hacking attempts on our websites. That sometimes leads us to finding what looks to be exploitation of vulnerabilities that a hacker has just discovered. In other cases it shows really old vulnerabilities that hackers are still trying to exploit. We have recently had some attempts to exploit a couple of vulnerabilities in older versions of the plugin Cherry Plugin. One was an arbitrary file upload vulnerability mentioned here and the other was an arbitrary file viewing vulnerability that we couldn’t find any prior mention of.

In version 1.2.6 and below the file /admin/import-export/download-content.php will serve up the contents of any file requested. It looks like that functionality was intended to be only accessible by admins, but there were no restrictions in place to prevent anyone else from accessing it. [Read more]

8 Jun 2016

Old Vulnerability Report: Arbitrary File Upload in Royal Gallery

Yesterday we released posts for vulnerabilities in 16 plugins, which all shared the same code that allowed anyone access to functions only intended to be accessible to Administrator level users. For two of those plugins though the most serious vulnerability permitted by this did not exist. That vulnerability was the ability to upload arbitrary files, which could allow a hacker to upload .php file and then use that to perform any action they want on the website.

Looking back through the old versions we can see that for one those plugins, Royal Gallery, that vulnerability had actually existed in version 2.0 and then was fixed in 2.1. In a reminder that you really need to keep all of your plugins up to date all the time, instead of trying to update them upon becoming aware of a security issue (which far to often WordPress security companies tacitly promote by telling people they should update some specific plugin right away), the changelog entry for that version reads only: [Read more]

31 May 2016

Old Vulnerability Report: Arbitrary File Upload in Magic Fields

One of the things that we do to keep track of the  plugin vulnerabilities out there is to monitor hacking attempts on our websites. That sometimes leads us to finding what looks to be exploitation of vulnerabilities that a hacker has just discovered. In other cases it shows really old vulnerabilities that hackers are still trying to exploit. We have recently had some requests for a file from the plugin Magic Fields:

 /wp-content/plugins/magic-fields/MF_Constant.php [Read more]