CVE-2018-25324
MEDIUMSimple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25324. PoCs published by Graeme Robinson.
AI-analyzed exploit summary The exploit demonstrates a local file inclusion (LFI) vulnerability in Simple Fields WordPress plugin versions 0.2 to 0.3.5, which can lead to remote code execution (RCE) by injecting PHP code into log files or leveraging allow_url_include. The vulnerability is due to improper handling of user input in the wp_abspath parameter, allowing null byte injection to terminate the string prematurely.
Description
Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wp_abspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wp_abspath values to simple_fields.php to include files like /etc/passwd or inject PHP code into Apache logs for remote code execution when allow_url_include is enabled.
Exploits (1)
The exploit demonstrates a local file inclusion (LFI) vulnerability in Simple Fields WordPress plugin versions 0.2 to 0.3.5, which can lead to remote code execution (RCE) by injecting PHP code into log files or leveraging allow_url_include. The vulnerability is due to improper handling of user input in the wp_abspath parameter, allowing null byte injection to terminate the string prematurely.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N