WordPress Aspose Cloud eBook Generator Arbitrary File Download Vulnerability
BID:73384
Info
WordPress Aspose Cloud eBook Generator Arbitrary File Download Vulnerability
| Bugtraq ID: | 73384 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 27 2015 12:00AM |
| Updated: | Mar 27 2015 12:00AM |
| Credit: | Ashiyane Digital Security Team. |
| Vulnerable: |
WordPress Aspose Cloud eBook Generator 1.0 |
| Not Vulnerable: | |
Discussion
WordPress Aspose Cloud eBook Generator Arbitrary File Download Vulnerability
The Aspose Cloud eBook Generator plugin for WordPress is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue to download arbitrary files within the context of the web server process. Information obtained may aid in further attacks.
Aspose Cloud eBook Generator 1.0 is vulnerable; other versions may also be affected.
The Aspose Cloud eBook Generator plugin for WordPress is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue to download arbitrary files within the context of the web server process. Information obtained may aid in further attacks.
Aspose Cloud eBook Generator 1.0 is vulnerable; other versions may also be affected.
Exploit / POC
WordPress Aspose Cloud eBook Generator Arbitrary File Download Vulnerability
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/wordpress/wp-content/plugins/aspose-cloud-ebook-generator/aspose_posts_exporter_download.php?file=[File Address]
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/wordpress/wp-content/plugins/aspose-cloud-ebook-generator/aspose_posts_exporter_download.php?file=[File Address]