Date: Fri, 28 Aug 2015 15:50:03 +0530 From: Dis close <disclose@...ersecurityworks.com> To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: CVE Request - LFI/Path Traversal in NextGen Gallery WordPress Plugin. Hi List: We are requesting CVE for the below mentioned security issue in NextGen Gallery Plugin: Plugin Details: ============== Plugin Name: NextGen Gallery Version: 2.1.7 Homepage: https://wordpress.org/plugins/nextgen-gallery/ Description =============== NextGEN Gallery is most popular *WordPress Gallery Plugin *with over 13 millions downloads. Vulnerability =============== The plugin fails to validate user input in one of the variables, which allows a log-in user to access system files and other unauthorized files on the server. POC Video Link: https://www.youtube.com/watch?v=KkPVMxubUis Proof of Concept ================ Accessing the POST request http://localhost/wordpress/?photocrati_ajax=1 and modifying the *dir* variable with ../../../ input user can traverse file system and access files even outside the application directory. Disclosure Timeline ================== 17-02-2015: Reported to WP Plugins 18-02-2015: Acknowledged by WP Plugin, saying that vendor will be informed. But till now no response from WP plugin or vendor. Discovered by ( Please provide credit to following) ===================================== Sathish Kumar Cyber Security Works Pvt Ltd. ---------- Cheers !!! Team CSW
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.