WordPress GD bbPress Attachments 2.1 Local File Inclusion

2015-07-13 / 2015-08-19
Credit: Tom Adams
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-98


CVSS Base Score: 4/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

Details ================ Software: GD bbPress Attachments Version: 2.1 Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/ Advisory report: https://security.dxw.com/advisories/local-file-include-vulnerability-in-gd-bbpress-attachments-allows-attackers-to-include-arbitrary-php-files/ CVE: Awaiting assignment CVSS: 4.3 (Medium; AV:N/AC:M/Au:N/C:N/I:N/A:P) Description ================ Local File Include vulnerability in GD bbPress Attachments allows attackers to include arbitrary PHP files Vulnerability ================ An attacker who isan admin can easily include any .php file on the server. An attacker who can get anadmin to follow a linkthey control will also beable to include that PHP file. It is easy to make these links very convincing. They could exploit this to attempt to exhaust the server?s resources by including the file that includes the arbitrary file in an infinite loop. If they?re additionally able to upload arbitrary PHP files (via an admin account or some other vulnerability) they?ll be able to run arbitrary code on the server. Proof of concept ================ Visit this URL to cause an infinite loop: http://localhost/wp-admin/edit.php?post_type=forum&page=gdbbpress_attachments&tab=../panels Mitigations ================ Upgrade to version 2.2 or later Disclosure policy ================ dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/ Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf. This vulnerability will be published if we do not receive a response to this report with 14 days. Timeline ================ 2015-02-25: Discovered 2015-07-01: Reported to vendor via email form onhttps://www.dev4press.com/contact/ 2015-07-01: Requested CVE 2015-07-01:Vendor responded 2015-07-09: Vendor confirmed fix 2015-07-09: Published Discovered by dxw: ================ Tom Adams Please visit security.dxw.com for more information.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top