PT-2021-8373 · Unknown+1 · Themify Framework+1

Published 2021-06-17 · Updated 2021-06-23 · CVE-2013-20002

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Elemin version before 1.2.2 Themify framework version before 1.2.2

Description The issue allows remote attackers to upload and execute arbitrary PHP code via the Themify framework. This is done through the wp-content/themes/elemin/themify/themify-ajax.php file.

Recommendations For Elemin version before 1.2.2, update to version 1.2.2 or later. For Themify framework version before 1.2.2, update to version 1.2.2 or later. As a temporary workaround, consider restricting access to the themify-ajax.php file until a patch is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2013-20002

Affected Products

Elemin

Themify Framework

References · 6

• 🔥 https://packetstormsecurity.com/files/124149/WordPress-Elemin-Shell-Upload.html · Exploit
• https://themify.me/blog/updated-themify-framework-to-fix-the-vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-20002 · Security Note
• https://themify.me/blog/urgent-vulnerability-found-in-themify-framework-please-read · Vendor Advisory
• https://t.me/cibsecurity/25527 · Telegram Post
• https://en.0day.today/exploit/22090 · Note