Aerosol Posted March 10, 2015 Report Posted March 10, 2015 *WordPress Daily Edition Theme v1.6.2 SQL Injection SecurityVulnerabilities*Exploit Title: WordPress Daily Edition Theme v1.6.2 /fiche-disque.php idParameters SQL Injection Security VulnerabilitiesProduct: WordPress Daily Edition ThemeVendor: WooThemesVulnerable Versions: v1.6.2Tested Version: v1.6.2Advisory Publication: Mar 07, 2015Latest Update: Mar 07, 2015Vulnerability Type: Improper Neutralization of Special Elements used in anSQL Command ('SQL Injection') [CWE-89]CVE Reference: *Impact CVSS Severity (version 2.0):CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)Impact Subscore: 6.4Exploitability Subscore: 10.0Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU),Singapore]*Advisory Details:**(1) Vendor & Product Description:**Vendor:*WooThemes*Product & Version:*WordPress Daily Edition Themev1.6.2*Vendor URL & Download:*WordPress Daily Edition Theme can be got from here,http://www.woothemes.com/products/daily-edition/*Product Introduction:*"Daily Edition WordPress Theme developed by wootheme team and Daily Editionis a clean, spacious newspaper/magazine theme designed by Liam McKay. Withloads of home page modules to enable/disable and a unique java script-basedfeatured scroller and video player the theme oozes sophistication""The Daily Edition theme offers users many options, controlled from thewidgets area and the theme options page – it makes both the themesappearance and functions flexible. From The Daily Edition 3 option pagesyou can for example add your Twitter and Google analytics code, some customCSS and footer content – and in the widgets area you find a practical adsmanagement.""Unique FeaturesThese are some of the more unique features that you will find within thetheme: A neat javascript home page featured slider, with thumbnail previews ofprevious/next slides on hover over the dots. A “talking points” home page that can display posts according to tags,in order of most commented to least commented. A great way to highlightposts gathering dust in the archives. A customizable home page layout with options to specify how many fullwidth blog posts and how many “box” posts you would like to display. A javascript home page video player with thumbnail hover effect. 16 delicious colour schemes to choose from!"*(2) Vulnerability Details:*WordPress Daily Edition Theme web application has a security bug problem.It can be exploited by SQL Injection attacks. This may allow a remoteattacker to inject or manipulate SQL queries in the back-end database,allowing for the manipulation or disclosure of arbitrary data.*(2.1)* The code flaw occurs at "fiche-disque.php?" page with "&id"parameter.*References:*http://www.tetraph.com/security/sql-injection-vulnerability/wordpress-daily-edition-theme-v1-6-2-sql-injection-security-vulnerabilities/http://securityrelated.blogspot.com/2015/03/wordpress-daily-edition-theme-v162-sql.htmlhttp://www.inzeed.com/kaleidoscope/computer-web-security/wordpress-daily-edition-theme-v1-6-2-sql-injection-security-vulnerabilities/http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/wordpress-daily-edition-theme-v1-6-2-sql-injection-security-vulnerabilities/https://itswift.wordpress.com/2015/03/07/wordpress-daily-edition-theme-v1-6-2-sql-injection-security-vulnerabilities/http://seclists.org/fulldisclosure/2015/Mar/27http://packetstormsecurity.com/files/130075/SmartCMS-2-SQL-Injection.html--Wang Jing,Division of Mathematical Sciences (MAS),School of Physical and Mathematical Sciences (SPMS),Nanyang Technological University (NTU),Singapore.http://www.tetraph.com/wangjing/https://plus.google.com/u/0/+JingWang-tetraph-justqdjing/postsSource*WordPress Daily Edition Theme v1.6.2 Unrestricted Upload of File SecurityVulnerabilities*Exploit Title: WordPress Daily Edition Theme v1.6.2 /thumb.php srcParameter Unrestricted Upload of File Security VulnerabilitiesProduct: WordPress Daily Edition ThemeVendor: WooThemesVulnerable Versions: v1.6.2Tested Version: v1.6.2Advisory Publication: Mar 07, 2015Latest Update: Mar 07, 2015Vulnerability Type: Unrestricted Upload of File with Dangerous Type[CWE-434]CVE Reference: *Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU),Singapore]*Advisory Details:**(1) Vendor & Product Description:**Vendor:*WooThemes*Product & Version:*WordPress Daily Edition Themev1.6.2*Vendor URL & Download:*WordPress Daily Edition Theme can be got from here,http://www.woothemes.com/products/daily-edition/*Product Introduction:*"Daily Edition WordPress Theme developed by wootheme team and Daily Editionis a clean, spacious newspaper/magazine theme designed by Liam McKay. Withloads of home page modules to enable/disable and a unique java script-basedfeatured scroller and video player the theme oozes sophistication""The Daily Edition theme offers users many options, controlled from thewidgets area and the theme options page – it makes both the themesappearance and functions flexible. From The Daily Edition 3 option pagesyou can for example add your Twitter and Google analytics code, some customCSS and footer content – and in the widgets area you find a practical adsmanagement.""Unique FeaturesThese are some of the more unique features that you will find within thetheme: A neat javascript home page featured slider, with thumbnail previews ofprevious/next slides on hover over the dots. A “talking points” home page that can display posts according to tags,in order of most commented to least commented. A great way to highlightposts gathering dust in the archives. A customizable home page layout with options to specify how many fullwidth blog posts and how many “box” posts you would like to display. A javascript home page video player with thumbnail hover effect. 16 delicious colour schemes to choose from!"*(2) Vulnerability Details:*WordPress Daily Edition Theme web application has a security bug problem.It can be exploited by "Unrestricted Upload of File" (Arbitrary FileUploading) attacks. With a specially crafted request, a remote attacker caninclude arbitrary files from the targeted host or from a remote or localhost . This may allow disclosing file contents or executing files like PHPscripts. Such attacks are limited due to the script only calling filesalready on the target host.*(2.1)* The code flaw occurs at "thumb.php?" page with "src" parameters.*References:*http://tetraph.com/security/unrestricted-upload-of-file-arbitrary/wordpress-daily-edition-theme-v1-6-2-unrestricted-upload-of-file-security-vulnerabilities/http://securityrelated.blogspot.com/2015/03/wordpress-daily-edition-theme-v162.htmlhttp://www.inzeed.com/kaleidoscope/computer-web-security/wordpress-daily-edition-theme-v1-6-2-unrestricted-upload-of-file-security-vulnerabilities/http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/wordpress-daily-edition-theme-v1-6-2-unrestricted-upload-of-file-security-vulnerabilities/https://itswift.wordpress.com/2015/03/07/wordpress-daily-edition-theme-v1-6-2-unrestricted-upload-of-file-security-vulnerabilities/http://seclists.org/fulldisclosure/2015/Mar/4http://packetstormsecurity.com/files/130653/Webshop-Hun-1.062S-Directory-Traversal.html--Wang Jing,Division of Mathematical Sciences (MAS),School of Physical and Mathematical Sciences (SPMS),Nanyang Technological University (NTU),Singapore.http://www.tetraph.com/wangjing/https://plus.google.com/u/0/+JingWang-tetraph-justqdjing/postsSource Quote
