Themes Vulnerabilities

Multiple Themes - Privilige Escalation

Description

The themes suffer from a privilege escalation vulnerability, any authenticated user can trigger this vulnerability due to weak permissions checking.

An attacker can update options, such as changing user's default role, registration state and others, which may lead to executing commands/code on the server and taking over the website.

Tested Versions:

Simpolio 1.3.2
Pont 1.5
Teardrop 1.8.1
Vernissage 1.2.8

Proof of Concept

Affects Themes

No known fix
No known fix
No known fix
Fixed in 1.3

References

Miscellaneous

Submitter
A. Samman
Submitter twitter
Verified
No

Timeline

Publicly Published
2015-06-26 (about 10 years ago)
Added
2015-06-26 (about 10 years ago)
Last Updated
2020-12-09 (about 5 years ago)

Other