CVE-2015-4153 - WordPress zM Ajax Login & Register Plugin [Local File Inclusion]

vendor:

zm_ajax_login_register

by:

Panagiotis Vagenas

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: zm_ajax_login_register

Affected Version From: 1.0.9

Affected Version To: 1.0.9

Patch Exists: YES

Related CWE: CVE-2015-4153

CPE: a:zanematthew:zm_ajax_login_register

Metasploit: https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2015-4153/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WordPress 4.2.2

2015

CVE-2015-4153 – WordPress zM Ajax Login & Register Plugin [Local File Inclusion]

Any authenticated or non-authenticated user can perform a local file inclusion attack by exploiting the wp_ajax_nopriv_load_template action. Plugin simply includes the file specified in 'template' POST parameter without any further validation.

Mitigation:

Update to version 1.1.0

Source

Exploit-DB raw data:

# Exploit Title: CVE-2015-4153 - WordPress zM Ajax Login & Register
Plugin [Local File Inclusion]
# Date: 2015/06/01
# Exploit Author: Panagiotis Vagenas
# Contact: https://twitter.com/panVagenas
# Vendor Homepage: http://zanematthew.com/
# Software Link:
https://downloads.wordpress.org/plugin/zm-ajax-login-register.1.0.9.zip
# Version: 1.0.9
# Tested on: WordPress 4.2.2
# Category: webapps
# CVE: CVE-2015-4153

* Description

Any authenticated or non-authenticated user can perform a local file
inclusion attack by exploiting the wp_ajax_nopriv_load_template action.
Plugin simply includes the file specified in 'template' POST parameter
without any further validation.

* Proof of Concept

Send a post request to
`http://my.vulnerable.website.com/wp-admin/admin-ajax.php` with data:
`action=load_template&template=[relative path to local
file]&security=[wp nonce]&referer=[action from which the nonce came from]`

* Timeline

2015/06/01 Discovered
2015/06/01 Vendor alerted via contact form at his website
2015/06/03 Vendor responded
2015/06/03 Fixed in version 1.1.0


* Solution

Update to version 1.1.0