WP-Filemanager <=1.2 — Arbitrary File Upload
The H-T Team have reported a vulnerability in WP-Filemanager.
***No proof of concept available***
The vulnerability is suppose to affect version 1.2. It may also affect earlier versions (in fact, this is likely). It is possible for an Attacker to upload Arbitrary PHP-Code, which can afterwards be executed with Webserver rights.
Currently there’s no vendor fix available. BlogSecurity recommend that users disable and remove the Plugin until a fix is available.
For the original Bug Disclosure visit SecurityFocus.
Random Posts
If you enjoyed this post, please leave a comment or subscribe to the feed and get future articles delivered to your feed reader.
PoC is available at milw0rm.com (from 6th of January).
Wordpress Plugin Wp-FileManager 1.2 Remote Upload Vulnerability
http://www.milw0rm.com/exploits/4844
So users of this plugin need to fix it or to disable it until fix will be released.