WordPress Custom Field Arbitrary File Upload Vulnerability

Bugtraq ID:	24642
Class:	Access Validation Error
CVE:	CVE-2007-3543
Remote:	Yes
Local:	No
Published:	Jun 26 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Alexander Concha is credited with the discovery of this vulnerability.
Vulnerable:	WordPress WordPress MU 1.2.2 WordPress WordPress 2.1.3 WordPress WordPress 2.1.2 WordPress WordPress 2.1.1 WordPress WordPress 2.0.10 WordPress WordPress 2.0.7 WordPress WordPress 2.0.6 WordPress WordPress 2.0.5 WordPress WordPress 2.0.4 WordPress WordPress 2.0.3 WordPress WordPress 2.0.2 WordPress WordPress 2.0.1 WordPress WordPress 2.0 WordPress WordPress 2.2 WordPress WordPress 2.1.3-RC2 WordPress WordPress 2.1.3-RC1 WordPress WordPress 2.1 WordPress WordPress 2.0.10-RC2 WordPress WordPress 2.0.10-RC1
Not Vulnerable:	WordPress WordPress MU 1.2.3 WordPress WordPress 2.2.1

WordPress Custom Field Arbitrary File Upload Vulnerability

WordPress is prone to an arbitrary-file-upload vulnerability.

An attacker can exploit this vulnerability to upload PHP script code and execute it in the context of the webserver process.

This issue affects WordPress 2.2.1, WordPress MU 1.2.3, and prior versions.

WordPress Custom Field Arbitrary File Upload Vulnerability

Attackers may exploit this issue through a browser.

The following proof of concept and exploit code are available:

• /data/vulnerabilities/exploits/24642.txt
• /data/vulnerabilities/exploits/24642.pl

WordPress Custom Field Arbitrary File Upload Vulnerability

Solution:
The vendor released updates to address this issue. Please see the references for more information.

WordPress Custom Field Arbitrary File Upload Vulnerability

References:

• Arbitrary File Upload Vulnerability in WordPress and WordPress MU (Alexander Concha)
  
• WordPress Changeset 1005 (Wordpress)