WordPress VideoWhisper Live Streaming Integration Arbitrary File Upload Vulnerability
BID:65866
Info
WordPress VideoWhisper Live Streaming Integration Arbitrary File Upload Vulnerability
| Bugtraq ID: | 65866 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-1905 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 27 2014 12:00AM |
| Updated: | Feb 27 2014 12:00AM |
| Credit: | High-Tech Bridge Security Research Lab |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
WordPress VideoWhisper Live Streaming Integration Arbitrary File Upload Vulnerability
The VideoWhisper Live Streaming Integration plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because it fails to properly validate file extensions before uploading them.
An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.
VideoWhisper Live Streaming Integration 4.27.3 is vulnerable; other versions may also be affected.
The VideoWhisper Live Streaming Integration plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because it fails to properly validate file extensions before uploading them.
An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.
VideoWhisper Live Streaming Integration 4.27.3 is vulnerable; other versions may also be affected.
Exploit / POC
WordPress VideoWhisper Live Streaming Integration Arbitrary File Upload Vulnerability
An attacker can exploit this issue using a web browser.
The following example URI is available:
http://www.example.com/wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/1.php.jpg
An attacker can exploit this issue using a web browser.
The following example URI is available:
http://www.example.com/wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/1.php.jpg
Solution / Fix
WordPress VideoWhisper Live Streaming Integration Arbitrary File Upload Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.