Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 28 Aug 2015 15:50:03 +0530
From: Dis close <>
Subject: CVE Request - LFI/Path Traversal in NextGen Gallery WordPress Plugin.

Hi List:

We are requesting CVE for the below mentioned security issue in NextGen
Gallery Plugin:

Plugin Details:
Plugin Name: NextGen Gallery
Version: 2.1.7

NextGEN Gallery is most popular *WordPress Gallery Plugin *with over 13
millions downloads.

The plugin fails to validate user input in one of the variables, which
allows a  log-in user to access system files and other unauthorized files
on the server.

POC Video Link:

Proof of Concept

Accessing the POST request http://localhost/wordpress/?photocrati_ajax=1
and modifying the *dir* variable with ../../../ input user can traverse
file system and access files even outside the application directory.

Disclosure Timeline

17-02-2015: Reported to WP Plugins
18-02-2015: Acknowledged by WP Plugin, saying that vendor will be informed.
But till now no response from WP plugin or vendor.

Discovered by ( Please provide credit to following)

Sathish Kumar
Cyber Security Works Pvt Ltd.

Cheers !!!

Team CSW

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ