A Remote Code Execution (RCE) vulnerability exists in pixelimity via admin/admin-ajax.php?action=install_theme.

[tuando243]

A Remote Code Execution (RCE) vulnerability exists in pixelimity via admin/admin-ajax.php?action=install_theme.

Step to exploit:

1. Login as admin.
2. Navigate to http://127.0.0.1/pixelimity/admin/themes.php.
3. Compress "shell.php" to "shell.zip" file and then upload via Install New Theme.
4. Visit http://127.0.0.1/pixelimity/themes/shell.php.