Menu

Improved exploit search engine. Try it out

"WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion"

Author

"Manuel García Cárdenas"

Platform

php

Release date

2019-03-13

Release Date Title Type Platform Author
2019-05-24 "Opencart 3.0.3.2 - 'extension/feed/google_base' Denial of Service PoC" webapps php "Todor Donev"
2019-05-23 "Nagios XI 5.6.1 - SQL injection" webapps php JameelNabbo
2019-05-22 "Horde Webmail 5.2.22 - Multiple Vulnerabilities" webapps php InfinitumIT
2019-05-21 "WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities" webapps php "Simone Quatrini"
2019-05-21 "Moodle Jmol Filter 6.1 - Directory Traversal / Cross-Site Scripting" webapps php "Dionach Ltd"
2019-05-23 "Shopware - createInstanceFromNamedArguments PHP Object Instantiation Remote Code Execution (Metasploit)" remote php Metasploit
2019-05-20 "eLabFTW 1.8.5 - Arbitrary File Upload / Remote Code Execution" webapps php liquidsky
2019-05-20 "GetSimpleCMS - Unauthenticated Remote Code Execution (Metasploit)" remote php Metasploit
2019-05-17 "Interspire Email Marketer 6.20 - 'surveys_submit.php' Remote Code Execution" webapps php "numan türle"
2019-05-16 "DeepSound 1.0.4 - SQL Injection" webapps php "Mehmet EMIROGLU"
2019-05-15 "Legrand BTicino Driver Manager F454 1.0.51 - Cross-Site Request Forgery / Cross-Site Scripting" webapps php LiquidWorm
2019-05-15 "CommSy 8.6.5 - SQL injection" webapps php "Jens Regel_ Schneider_ Wulf"
2019-05-14 "PasteShr 1.6 - Multiple SQL Injection" webapps php "Mehmet EMIROGLU"
2019-05-14 "Schneider Electric U.Motion Builder 1.3.4 - 'track_import_export.php object_id' Unauthenticated Command Injection" webapps php "Julien Ahrens"
2019-05-14 "Sales ERP 8.1 - Multiple SQL Injection" webapps php "Mehmet EMIROGLU"
2019-05-14 "PHP-Fusion 9.03.00 - 'Edit Profile' Remote Code Execution (Metasploit)" remote php AkkuS
2019-05-13 "OpenProject 5.0.0 - 8.3.1 - SQL Injection" webapps php "SEC Consult"
2019-05-13 "XOOPS 2.5.9 - SQL Injection" webapps php "felipe andrian"
2019-05-13 "SOCA Access Control System 180612 - Cross-Site Request Forgery (Add Admin)" webapps php LiquidWorm
2019-05-13 "SOCA Access Control System 180612 - SQL Injection" webapps php LiquidWorm
2019-05-13 "SOCA Access Control System 180612 - Information Disclosure" webapps php LiquidWorm
2019-05-09 "Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Cross-Site Scripting" webapps php "Ibrahim Raafat"
2019-05-06 "PHPads 2.0 - 'click.php3?bannerID' SQL Injection" webapps php "felipe andrian"
2019-05-03 "Wordpress Plugin Social Warfare < 3.5.3 - Remote Code Execution" webapps php hash3liZer
2019-05-03 "Instagram Auto Follow - Authentication Bypass" webapps php Veyselxan
2019-04-30 "Agent Tesla Botnet - Information Disclosure" webapps php n4pst3r
2019-04-30 "Hyvikk Fleet Manager - Shell Upload" webapps php saxgy1331
2019-04-30 "Joomla! Component JiFile 2.3.1 - Arbitrary File Download" webapps php "Mr Winst0n"
2019-04-30 "HumHub 1.3.12 - Cross-Site Scripting" webapps php "Kağan EĞLENCE"
2019-04-30 "Joomla! Component ARI Quiz 3.7.4 - SQL Injection" webapps php "Mr Winst0n"
Release Date Title Type Platform Author
2019-03-13 "WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion" webapps php "Manuel García Cárdenas"
2018-09-19 "WordPress Plugin Localize My Post 1.0 - Local File Inclusion" webapps php "Manuel García Cárdenas"
2018-09-19 "WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion" webapps php "Manuel García Cárdenas"
2018-06-11 "WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection" webapps php "Manuel García Cárdenas"
2018-04-18 "Kodi 17.6 - Persistent Cross-Site Scripting" webapps multiple "Manuel García Cárdenas"
2018-03-12 "TextPattern 4.6.2 - 'qty' SQL Injection" webapps php "Manuel García Cárdenas"
2017-04-11 "WordPress Plugin Spider Event Calendar 1.5.51 - Blind SQL Injection" webapps php "Manuel García Cárdenas"
2016-04-26 "ImpressCMS 1.3.9 - SQL Injection" webapps php "Manuel García Cárdenas"
2016-02-04 "UliCMS v9.8.1 - SQL Injection" webapps php "Manuel García Cárdenas"
2013-06-03 "Telaen - Information Disclosure" webapps php "Manuel García Cárdenas"
2013-06-04 "Telaen 2.7.x - Open Redirection" webapps php "Manuel García Cárdenas"
2013-06-04 "Telaen 2.7.x - Cross-Site Scripting" webapps php "Manuel García Cárdenas"
2015-10-06 "PHP-Fusion 7.02.07 - Blind SQL Injection" webapps php "Manuel García Cárdenas"
2013-03-10 "Asteriskguru Queue Statistics - 'warning' Cross-Site Scripting" webapps php "Manuel García Cárdenas"
2014-11-17 "Zoph 0.9.1 - Multiple Vulnerabilities" webapps php "Manuel García Cárdenas"
2014-11-17 "WebsiteBaker 2.8.3 - Multiple Vulnerabilities" webapps php "Manuel García Cárdenas"
2014-11-13 "Piwigo 2.6.0 - 'picture.php?rate' SQL Injection" webapps php "Manuel García Cárdenas"
2013-09-30 "XAMPP 1.8.1 - 'lang.php?WriteIntoLocalDisk method' Local Write Access" webapps php "Manuel García Cárdenas"
2016-09-22 "Exponent CMS 2.3.9 - Blind SQL Injection" webapps php "Manuel García Cárdenas"
2017-12-15 "Sync Breeze 10.2.12 - Denial of Service" dos windows "Manuel García Cárdenas"
2018-01-12 "PyroBatchFTP < 3.19 - Buffer Overflow" dos windows "Manuel García Cárdenas"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46537/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46537/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46537/40986/wordpress-plugin-gracemedia-media-player-10-local-file-inclusion/download/", "exploit_id": "46537", "exploit_description": "\"WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion\"", "exploit_date": "2019-03-13", "exploit_author": "\"Manuel Garc\u00eda C\u00e1rdenas\"", "exploit_type": "webapps", "exploit_platform": "php", "exploit_port": null}
                                            

For full documentation follow the link above

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
=============================================
MGC ALERT 2019-001
- Original release date: February 06, 2019
- Last revised:  March 13, 2019
- Discovered by: Manuel García Cárdenas
- Severity: 7/10 (CVSS Base Score)
- CVE-ID: CVE-2019-9618
=============================================

I. VULNERABILITY
-------------------------
WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion

II. BACKGROUND
-------------------------
Hassle-free and user-friendly way to add a Media player directly to your
website.

III. DESCRIPTION
-------------------------
This bug was found in the file:

/gracemedia-media-player/templates/files/ajax_controller.php

Vulnerable code:

require_once($_GET['cfg']);

The parameter "cfg" it is not sanitized allowing include local files

To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application.

IV. PROOF OF CONCEPT
-------------------------
The following URL have been confirmed that is vulnerable to local file
inclusion.

Local File Inclusion POC:

GET
/wordpress/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../etc/passwd

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
GraceMedia Media Player <= 1.0

VII. SOLUTION
-------------------------
Disable plugin until a fix is available, vendor does not fix after 2
requests.

VIII. REFERENCES
-------------------------
https://es.wordpress.org/plugins/gracemedia-media-player/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
February 06, 2019 1: Initial release
March 13, 2019 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
February 06, 2019 1: Vulnerability acquired by Manuel Garcia Cardenas
February 06, 2019 2: Email to vendor without response
February 21, 2019 3: Second email to vendor without response
March 13, 2019 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester