WordPress DZS-VideoGallery Unauthenticated File Upload

An unauthenticated file upload vulnerability exists in the upload.php script used in the WordPress plugin DZS-VideoGallery. Under certain conditions, an attacker is able to upload PHP to the target webserver via exploitation of the upload.php script. This can result in the ability to execute PHP on the webserver. Authentication is not required to perform this attack.

Exploitation

Stages

1. The attacker sends a specially crafted request to DZS Video Gallery’s ‘upload.php’ script with PHP contained in the POST body.
2. The uploaded PHP is stored by DZS Video Gallery and a success message is returned to the attacker.

Prerequisites

The vulnerable DZS-VideoGallery plugin (versions unknown) with public-facing access to upload.php is enabled (default).

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

Upgrade to a non-vulnerable version to mitigate this vulnerability.