Lucene search
Larry W. CashdollarWPEX-ID:427F5BF4-4D2D-4B9A-9E30-1E3EB52D7F19HistoryJul 18, 2015 - 12:00 a.m.
wptf-image-gallery 1.0.3 - Remote File Download
2015-07-1800:00:00
Larry W. Cashdollar
17
0.008 Low
EPSS
Percentile
81.8%
Plugin is still affected and has been closed. The ./wptf-image-gallery/lib-mbox/ajax_load.php code doesn’t sanitize user input or check that a user is authorized to download files. This allows an unauthenticated user to download sensitive system files: 1
$ curl http://www.example.com/wp-content/plugins/wptf-image-gallery/lib-mbox/ajax_load.php?url=/etc/passwdRelated
wpvulndb
wpvulndb
wptf-image-gallery 1.0.3 - Remote File Download
2015-07-18 00:00:00
cvelist
cvelist
CVE-2015-1000007
2016-10-06 14:00:00
cve
cve
CVE-2015-1000007
2016-10-06 14:59:08
prion
prion
Remote file inclusion
2016-10-06 14:59:00
nvd
nvd
CVE-2015-1000007
2016-10-06 14:59:08
openvas
openvas