What this actually is.
Technical background, root cause, and affected surface.
In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
- Vendor
- NextGen Gallery
- Affected Product
- NextGen Gallery
- CVE
- CVE-2015-9228
- Securin ID
- 2015-CSW-09-1008
- Status
- Fixed
- Date
- September 4, 2015
- Severity
- High
- CVSS Score
- 8.8
- Vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-434
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Visit the following page on a site with this plugin installed in the following URL http://yourwordpresssite.com/wordpress/wp-admin/post-new.php?post_type=wpsc-product which CVE-2015-9228 is vulnerable to file upload in file and name variable from which name variable extension is modified from JPG to PHP and file variable containing image content/information is semi-modified with PHP shell to be executed in the server which can be accessed with the help of publicly available URL. here, it is http://yourwordpresssite.com/wordpress/wp-content/gallery/xss/T.php?i=1523488308
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
A remote attacker could send a multipart/form-data POST request with a specially-crafted filename or mime type and execute arbitrary code.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Restrict file types accepted for upload: check the file extension and only allow certain files to be uploaded. Use a whitelist approach instead of a blacklist.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered in NextGen Gallery 2.1.10 version
Reported to plugins@wordpress.org
The vendor acknowledged the issue.
Fixed in NextGen Gallery 2.1.15 version
CVE Requested.
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.