NextGEN Gallery < 3.39 - Admin+ Local File Inclusion

2023-09-2500:00:00

Alex Sanford

local file inclusion

nextgen gallery

admin+

customize display settings

developer tools

exploit

5.2 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.2%

JSON

Description The plugin does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks

1. Create a gallery and upload an image.
2. Add the NextGEN Gallery block to a page and click Edit. Select the Gallery created in the previous step.
3. In "Customize Display Settings", using the developer tools, set the value of the "Select View" field to "default/../../../../../../../../../../../../../../../../../../../../../../../../../../../../etc/passwd"
4. Save and load the page to view the contents of `/etc/passwd`.