exploit the possibilities

WordPress GD bbPress Attachments 2.1 Local File Inclusion

WordPress GD bbPress Attachments 2.1 Local File Inclusion
Posted Jul 12, 2015
Authored by Tom Adams

WordPress GD bbPress Attachments plugin version 2.1 suffers from a local file inclusion vulnerability.

tags | exploit, local, file inclusion
MD5 | 5fab9b69357dbdb9a74ebc9ac27059a4

WordPress GD bbPress Attachments 2.1 Local File Inclusion

Change Mirror Download
Details
================
Software: GD bbPress Attachments
Version: 2.1
Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/
Advisory report: https://security.dxw.com/advisories/local-file-include-vulnerability-in-gd-bbpress-attachments-allows-attackers-to-include-arbitrary-php-files/
CVE: Awaiting assignment
CVSS: 4.3 (Medium; AV:N/AC:M/Au:N/C:N/I:N/A:P)

Description
================
Local File Include vulnerability in GD bbPress Attachments allows attackers to include arbitrary PHP files

Vulnerability
================
An attacker who is an admin can easily include any .php file on the server.
An attacker who can get an admin to follow a link they control will also be able to include that PHP file. It is easy to make these links very convincing.
They could exploit this to attempt to exhaust the server’s resources by including the file that includes the arbitrary file in an infinite loop.
If they’re additionally able to upload arbitrary PHP files (via an admin account or some other vulnerability) they’ll be able to run arbitrary code on the server.
 

Proof of concept
================
Visit this URL to cause an infinite loop:
http://localhost/wp-admin/edit.php?post_type=forum&page=gdbbpress_attachments&tab=../panels

Mitigations
================
Upgrade to version 2.2 or later

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2015-02-25: Discovered
2015-07-01: Reported to vendor via email form on https://www.dev4press.com/contact/
2015-07-01: Requested CVE
2015-07-01: Vendor responded
2015-07-09: Vendor confirmed fix
2015-07-09: Published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.




Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    60 Files
  • 2
    Apr 2nd
    0 Files
  • 3
    Apr 3rd
    0 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    0 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    0 Files
  • 9
    Apr 9th
    0 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    0 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close