[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAMWaY3M07iTMoOswVgZR172J-4PB6UN6Xt0TsoZXKsUGSwdNxw@mail.gmail.com>
Date: Fri, 28 Aug 2015 15:50:03 +0530
From: Dis close <disclose@...ersecurityworks.com>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE Request - LFI/Path Traversal in NextGen Gallery WordPress Plugin.
Hi List:
We are requesting CVE for the below mentioned security issue in NextGen
Gallery Plugin:
Plugin Details:
==============
Plugin Name: NextGen Gallery
Version: 2.1.7
Homepage: https://wordpress.org/plugins/nextgen-gallery/
Description
===============
NextGEN Gallery is most popular *WordPress Gallery Plugin *with over 13
millions downloads.
Vulnerability
===============
The plugin fails to validate user input in one of the variables, which
allows a log-in user to access system files and other unauthorized files
on the server.
POC Video Link: https://www.youtube.com/watch?v=KkPVMxubUis
Proof of Concept
================
Accessing the POST request http://localhost/wordpress/?photocrati_ajax=1
and modifying the *dir* variable with ../../../ input user can traverse
file system and access files even outside the application directory.
Disclosure Timeline
==================
17-02-2015: Reported to WP Plugins
18-02-2015: Acknowledged by WP Plugin, saying that vendor will be informed.
But till now no response from WP plugin or vendor.
Discovered by ( Please provide credit to following)
=====================================
Sathish Kumar
Cyber Security Works Pvt Ltd.
----------
Cheers !!!
Team CSW
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
