Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 09 Jul 2015 15:11:33 -0400
From: "Larry W. Cashdollar" <>
To: Open Source Security <>
Subject: Remote file download vulnerability in ibs-Mappro v0.6 Wordpress plugin

Title: Remote file download vulnerability in ibs-Mappro v0.6 Wordpress plugin
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-08
Download Site:
Vendor: Hmoore71
Vendor Notified: 2015-07-08, resolved in v1.0.
Vendor Contact: Contacted via webform
Description: IBS Mappro is a comprehensive map creator, editor, and view generator based on the Google Maps API v3 and supports kml, kmz, and gpx map files.
the download.php script allows any remote user to download files off of the server:
if (isset($_GET)) {
    $filename = $_GET['file'];
    $info = pathinfo($filename);
    $name = $info['basename'];
    if (file_exists($filename)) {
        header('Set-Cookie: fileDownload=true; path=/');
        header('Cache-Control: max-age=60, must-revalidate');
        header('Content-Disposition: attachment; filename="' . $title . '-' . $timestamp . '.csv"');
        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . $name . '"');
        header('Content-Transfer-Encoding: binary');
        header('Expires: 0');
        header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
        header('Pragma: public');
        header('Content-Length: ' . filesize($filename));
    } else {
} else {
CVEID: Please assign.
Exploit Code:

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.