PT-2017-7556 · Photocrati · Photocrati Nextgen Gallery

Sathish · Published 2017-09-12 · Updated 2020-10-29 · CVE-2015-9228

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Photocrati NextGEN Gallery plugin version 2.1.10

Description The issue concerns unrestricted file upload in the Photocrati NextGEN Gallery plugin for WordPress. This is achieved by modifying the file extension, for example, from .jpg to .php, using the name parameter in post-new.php.

Recommendations For version 2.1.10, consider restricting file uploads to only allowed extensions to prevent potential exploitation. As a temporary workaround, restrict access to the post-new.php file until a patch is available. Avoid using the name parameter in the affected endpoint until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2015-9228

Affected Products

Photocrati Nextgen Gallery

References · 8

• https://github.com/cybersecurityworks/Disclosed/issues/6 · Vendor Advisory
• https://wordpress.org/plugins/nextgen-gallery/#developers · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-9228 · Security Note
• http://openwall.com/lists/oss-security/2015/10/27/6 · Note
• https://wpvulndb.com/vulnerabilities/9758 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9228 · Note
• https://cybersecurityworks.com/zerodays/cve-2015-9228-crony.html · Note
• https://packetstormsecurity.com/files/135061/WordPress-NextGEN-Gallery-2.1.10-Shell-Upload.html · Note