CVE-2012-1011 – AllWebMenus WordPress Menu Plugin <= 1.1.8 - Arbitrary File Upload

https://notcve.org/view.php?id=CVE-2012-1011

actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. actions.php en el complemento AllWebMenus v1.1.8 para WordPress, permite a atacantes remotos evitar restricciones de acceso intencionadas para subir y ejecutar código PHP de su elección estableciendo el HTTP_REFERER a un determinado valor, subiendo un archivo ZIP que contenga el archivo PHP y accediendo a este a través de una petición directa al archivo en un directorio no especificado. The "AllWebMenus WordPress Menu Plugin" plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the actions.php file in versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. In versions 1.1.8, it's required to set the HTTP_REFERER to a certain value in order to bypass the referer protection added in v1.1.8. • https://www.exploit-db.com/exploits/18407 http://archives.neohapsis.com/archives/bugtraq/2012-01/0137.html http://secunia.com/advisories/47659 http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog http://www.exploit-db.com/exploits/18407 http://www.securityfocus.com/bid/51615 https://exchange.xforce.ibmcloud.com/vulnerabilities/72640 • CWE-264: Permissions, Privileges, and Access Controls CWE-434: Unrestricted Upload of File with Dangerous Type •