Input validation

The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vwupload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code...

CVE-2015-9272

The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vwupload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code...

CVE-2015-9272

The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vwupload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code...

WordPress VideoWhisper Video Presentation Plugin 3.31.17 /vp/vw_upload.php 文件上传漏洞

/vp/vwupload.php?php if $GET"room" $room=$GET"room"; if $POST"room" $room=$POST"room"; $filename=$FILES'vwfile''name'; includeonce"incsan.php"; sanV$room; if !$room exit; sanV$filename; if strstr$filename,".php" $filename = ""; //duplicate php extension not allowed due to vulnerabilities of older...