############################################################################### # Exploit Title : WordPress all_in_one_bannerRotator Plugins 4.9.9 File Information Exposure # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 14/01/2019 # Vendor Homepage : lambertgroupproductions.com ~ responsivejqueryslider.com # Software Download Link : downloads.wordpress.org/plugin/all-in-one-slider.zip # Software Information Links : responsivejqueryslider.com/banner_rotator.html + responsivejqueryslider.com/wordpressplugin/banner_rotator_responsive.html + codecanyon.net/item/all-in-one-slider-responsive-jquery-slider-plugin/1534434?ref=LambertGroup + lambertgroupproductions.com/portfolio_page/one-slider-responsive-jquery-slider-plugin/ # Software Price : 11$ # Tested On : Windows and Linux # Category : WebApps # Affected Versions : 1.1 - 3. 0 - 3.2 - 3.5.0 - 4.7.12 - 4.9.9 # Exploit Risk : High # Google Dorks : inurl:"/wp-content/plugins/all_in_one_bannerRotator/" # Vulnerability Type : CWE-200 [ Information Exposure ] CWE-538 [ File and Directory Information Exposure ] CWE-22 [ Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') ] ############################################################################### # Impact : *********** * WordPress all_in_one_bannerRotator Plugins 4.9.9 and other versions is prone to an arbitrary file disclosure vulnerability because it fails to properly sanitize user-supplied input. * An attacker can exploit this vulnerability to view local files in the context of the web server process, which may aid in launching further attacks. * An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information. * The product stores sensitive information in files or directories that are accessible to actors outside of the intended control sphere. * The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. ############################################################################### # Video Tutorials => ******************* Step 1: Installation – youtube.com/watch?v=D8rQdXzEz0o Step 2: Manage Images – youtube.com/watch?v=ULrPCuP0rnQ Step 3: Manage Text Over Image – youtube.com/watch?v=4KqgWBmx8RA Step 4: Manage Multiple Banners – youtube.com/watch?v=y2wnD3hUdus ############################################################################### # Exploit : ************* /wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php /wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php?page=all_in_one_bannerRotator_Manage_Banners /wp-content/plugins/all_in_one_bannerRotator/tpl/add_playlist_record.php /wp-content/plugins/all_in_one_bannerRotator/tpl/banners.php /wp-content/plugins/all_in_one_bannerRotator/tpl/help.php /wp-content/plugins/all_in_one_bannerRotator/tpl/overview.php /wp-content/plugins/all_in_one_bannerRotator/tpl/overview.php?page=all_in_one_bannerRotator_Add_New /wp-content/plugins/all_in_one_bannerRotator/tpl/overview.php?page=all_in_one_bannerRotator_Manage_Banners /wp-content/plugins/all_in_one_bannerRotator/tpl/overview.php?page=all_in_one_bannerRotator_Help /wp-content/plugins/all_in_one_bannerRotator/tpl/playlist.php /wp-content/plugins/all_in_one_bannerRotator/tpl/add_playlist_record.php?page=all_in_one_bannerRotator_Playlist /wp-content/plugins/all_in_one_bannerRotator/tpl/playlist_elements_over_image.php /wp-content/plugins/all_in_one_bannerRotator/tpl/preview.html /wp-content/plugins/all_in_one_bannerRotator/tpl/settings_form.php ############################################################################### # Example Vulnerable Sites : **************************** [+] amf-lebanon.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_playlist_record.php [+] hotel-le-verseau.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] wolfetours.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] sklawfirm.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] ecolestetiennedeseaux.fr/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] warrentonfamilydentistry.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] icaran.cl/headhunters/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] oha.net.au/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] neostrata.ie/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] dash.gr/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] mydebtadvisors.com/dev/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] downtoearthlawn.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] marketingdepartmentinc.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] veepraces.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] mvucc.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] thebutlerschool.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] mckannafabs.com.au/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] susanelanjones.co.uk/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] animalrepro.com/wp-content/plugins/all_in_one_bannerRotator//tpl/add_banner.php [+] carh.org/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] orsrents.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] trechomes.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] primepowdercoating.com.au/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] baystateconsultants.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] cardiff-lift.co.uk/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] triplesservices.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] homeleisure.com.au/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] perryverroneroofing.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] emmaswebsite.com.au/esh/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] viatorians.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] avantec.se/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] bodycorpservices.co.nz/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] ultrafin.co.za/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] smartindia.co.in/influx/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] lejagroup.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] vibrantjersey.je/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] casadovelhodragoeiro.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] triplesservices.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php [+] pegasostravel.com/wp-content/plugins/all_in_one_bannerRotator/tpl/add_banner.php ############################################################################### # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team #################################################################################################