WordPress Archin Theme Cross Site Scripting and Arbitrary File Upload Vulnerabilities
BID:55692
Info
WordPress Archin Theme Cross Site Scripting and Arbitrary File Upload Vulnerabilities
| Bugtraq ID: | 55692 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 22 2012 12:00AM |
| Updated: | Sep 22 2012 12:00AM |
| Credit: | Tom (aka DigiP). |
| Vulnerable: |
WordPress Archin Theme 3.2 |
| Not Vulnerable: | |
Discussion
WordPress Archin Theme Cross Site Scripting and Arbitrary File Upload Vulnerabilities
WordPress Archin Theme is prone to a cross-site scripting vulnerability and an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input.
Attackers can exploit these issues to steal cookie-based authentication information, execute arbitrary scripts in the context of the browser, upload and execute arbitrary files in the context of the web server, and launch other attacks.
WordPress Archin Theme 3.2 is vulnerable; other versions may also be affected.
WordPress Archin Theme is prone to a cross-site scripting vulnerability and an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input.
Attackers can exploit these issues to steal cookie-based authentication information, execute arbitrary scripts in the context of the browser, upload and execute arbitrary files in the context of the web server, and launch other attacks.
WordPress Archin Theme 3.2 is vulnerable; other versions may also be affected.
Exploit / POC
WordPress Archin Theme Cross Site Scripting and Arbitrary File Upload Vulnerabilities
Attackers can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
Attackers can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
WordPress Archin Theme Cross Site Scripting and Arbitrary File Upload Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
WordPress Archin Theme Cross Site Scripting and Arbitrary File Upload Vulnerabilities
References:
References:
- Archin WordPress Theme Multiple Vulnerabilities (Tom (aka DigiP))
- MaxButtons Plugin Home Page (WordPress )