複数のWordPressプラグイン

ソフト名：WordPress MediaRSS external gallery Plugin 0.1, WordPress Extend WordPress Free Version Plugin 2.1.01, WordPress Kino Gallery Plugin 1.0, WordPress Auto Attachments Plugin 0.3, WordPress Category Grid View Gallery Plugin 0.1.1, WordPress Verve Meta Boxes Plugin 1.2.8, WordPress WP Marketplace Plugin 1.1.0, WordPress Cms Pack Plugin 1.3, WordPress DP Thumbnail Plugin 1.0, WordPress LISL Last-Image Slider Plugin 1.0, WordPress Rent-A-Car Plugin 1.0, WordPress Rekt Slideshow Plugin 1.0.5, WordPress VK Gallery Plugin 1.1.0, WordPress Category List Portfolio Page Plugin 1.2.3 (TimThumb 1.34未満)

回避策：0.2へのアップデートにて対応, 2.1.02へのアップデートにて対応, 1.1以降へのアップデートにて対応, 未対応, 未対応, 1.2.9へのアップデートにて対応, 未対応, 1.4へのアップデートにて対応, 未対応, 未対応, 未対応, 未対応, 未対応, 未対応

脆弱性：システムアクセス, PHPファイルのアップロード, PHPコード実行

ソース：

http://wordpress.org/extend/plugins/mediarss-external-gallery/

http://wordpress.org/extend/plugins/extend-wordpress/

http://wordpress.org/extend/plugins/kino-gallery/

http://wordpress.org/extend/plugins/auto-attachments/

http://wordpress.org/extend/plugins/

http://wordpress.org/extend/plugins/verve-meta-boxes/

http://wordpress.org/extend/plugins/cms-pack/

http://www.rektproductions.com/rektslideshow/

http://ilovecode.ru/plagin-vk-gallery/

http://wordpress.org/extend/plugins/mediarss-external-gallery/changelog/

http://spareclockcycles.org/2011/09/18/exploitring-the-wordpress-extension-repos/

http://plugins.trac.wordpress.org/changeset/439125/mediarss-external-gallery/trunk/timthumb.php?old=376362&old_path=mediarss-external-gallery%2Ftrunk%2Ftimthumb.php

http://plugins.trac.wordpress.org/changeset/440701/extend-wordpress

http://wordpress.org/extend/plugins/kino-gallery/changelog/

http://plugins.trac.wordpress.org/changeset?reponame=&new=438967%40kino-gallery&old=422567%40kino-gallery

http://wordpress.org/extend/plugins/verve-meta-boxes/changelog/

http://plugins.trac.wordpress.org/changeset?reponame=&new=440885%40verve-meta-boxes&old=408945%40verve-meta-boxes

http://wordpress.org/extend/plugins/cms-pack/changelog/

http://plugins.trac.wordpress.org/changeset?reponame=&new=439015%40cms-pack&old=392679%40cms-pack

http://secunia.com/advisories/45416/

http://secunia.com/advisories/45795/

http://secunia.com/advisories/46028/

http://secunia.com/advisories/46036/

http://secunia.com/advisories/46066/

http://secunia.com/advisories/46071/

http://secunia.com/advisories/46072/

http://secunia.com/advisories/46085/

http://secunia.com/advisories/46088/

http://secunia.com/advisories/46090/

http://secunia.com/advisories/46092/

http://secunia.com/advisories/46098/

http://secunia.com/advisories/46100/

http://secunia.com/advisories/46106/

http://secunia.com/advisories/46108/

http://dvw-j.blogspot.com/2011/08/timthumb.html

危険性：High Risk