An arbitrary file upload vulnerability exists in the WordPress plugin open-flash-chart-core. An unauthenticated attacker can upload a file and execute arbitrary code on the target system.
- The remote unauthenticated attacker sends a request to ‘/php-ofc-library/ofc_upload_image.php?name=’. The uploaded malicious file will be in the name parameter.
- The server responds successfully with the location of the uploaded file.
- The attacker sends a request to ‘tmp-upload-images/<malicious file>.php’ to retrieve the uploaded file.
The target server must have the vulnerable version of the plugin running.
An arbitrary file upload vulnerability exists in the WordPress plugin open-flash-chart-core. The vulnerability resides within the file ‘ofc_upload_image.php’. No authentication checks are carried out on the user requesting the file. Also, no validation checks are made on the file being uploaded. An unauthenticated attacker can upload a file and execute arbitrary code on the target system.
Alert Logic Coverage
Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.
The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.
Detection of this threat is provided via Alert Logic ActiveWatch for Web Security Manager service. Depending on your deployment of Web Security Manager, you will receive an incident (for out-of-band deployment) or the threat will be actively blocked and rejected (for the inline Web Security Manager Premier deployment) if an exploit attempt is observed.
Recommendations for Mitigation
Upgrade to the latest version of the plugin to mitigate this vulnerability.