PT-2023-12626 · WordPress · Club-Theme+9

Joshua Small · Publicado 2023-01-23 · Atualizado 2023-01-31 · CVE-2022-0316

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeStand WordPress theme versions prior to 2.1 footysquare WordPress theme aidreform WordPress theme statfort WordPress theme club-theme WordPress theme kingclub-theme WordPress theme spikes WordPress theme spikes-black WordPress theme soundblast WordPress theme bolster WordPress theme

Description The issue concerns a lack of authorization and upload validation in the lang upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server. This enables potential malicious activities without proper access controls.

Recommendations For WeStand WordPress theme version prior to 2.1, update to version 2.1 or later. For footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, and bolster WordPress theme, consider disabling the lang upload.php file until a patch is available to prevent unauthorized file uploads.

Exploit

Correção

Identificadores relacionados

CVE-2022-0316

Produtos afetados

Westand

Aidreform

Bolster

Club-Theme

Footysquare

Kingclub-Theme

Soundblast

Spikes

Spikes-Black

Statfort

Referências · 6

• 🔥 https://github.com/KTN1990/CVE-2022-0316_wordpress_multiple_themes_exploit · Exploit
• 🔥 https://wpscan.com/vulnerability/9ab3d6cf-aad7-41bc-9aae-dc5313f12f7c · Exploit
• https://osv.dev/vulnerability/CVE-2022-0316 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-0316 · Nota de Segurança
• https://t.me/cibsecurity/56851 · Publicação no Telegram
• https://t.me/cvenotify/43216 · Publicação no Telegram