NextGen Gallery WordPress Plugin LFI/Path Traversal

2015.08.28
Credit: Team CSW
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

Hi List: We are requesting CVE for the below mentioned security issue in NextGen Gallery Plugin: Plugin Details: ============== Plugin Name: NextGen Gallery Version: 2.1.7 Homepage: https://wordpress.org/plugins/nextgen-gallery/ Description =============== NextGEN Gallery is most popular *WordPress Gallery Plugin *with over 13 millions downloads. Vulnerability =============== The plugin fails to validate user input in one of the variables, which allows a log-in user to access system files and other unauthorized files on the server. POC Video Link: https://www.youtube.com/watch?v=KkPVMxubUis Proof of Concept ================ Accessing the POST request http://localhost/wordpress/?photocrati_ajax=1 and modifying the *dir* variable with ../../../ input user can traverse file system and access files even outside the application directory. Disclosure Timeline ================== 17-02-2015: Reported to WP Plugins 18-02-2015: Acknowledged by WP Plugin, saying that vendor will be informed. But till now no response from WP plugin or vendor. Discovered by ( Please provide credit to following) ===================================== Sathish Kumar Cyber Security Works Pvt Ltd. ---------- Cheers !!! Team CSW

References:

https://www.youtube.com/watch?v=KkPVMxubUis


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top