nevma adaptive_images Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2019-14206 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC, 1 Nuclei template, and 1 lab environment.
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST['adaptive-images-settings'] parameter in adaptive-images-script.php.
| Product | Source | Version range | Status |
|---|---|---|---|
adaptive_imagesBrowse nevma / adaptive_images | VulnCheck | Version data not supplied | |
A Docker Compose environment that deploys a WordPress instance with a vulnerable version of the Adaptive Images plugin, intended as a proof-of-concept lab for CVE-2019-14206.
docker-compose.yml:1-35README.md:1-572The README explicitly states the environment is for demonstrating CVE-2019-14206, an arbitrary file deletion vulnerability in the Adaptive Images WordPress plugin. The Docker Compose file sets up a WordPress service with the vulnerable plugin mounted, and numerous scripts simulate or execute the exploit.
README.md:1-5docker-compose.yml:1-35A WordPress service based on the 'wordpress:latest' image. It exposes port 8888 on the host and mounts the local './plugin' directory to the plugin path, making the vulnerable Adaptive Images script accessible.
docker-compose.yml:4-17A MySQL 5.7 database service used by the WordPress instance. It stores WordPress data in a named volume.
docker-compose.yml:19-28The core vulnerable script from the Adaptive Images plugin. It processes image requests and contains the unsanitized input handling that leads to arbitrary file deletion. It is mounted into the WordPress container.
docker-compose.yml:14plugin/adaptive-images-script.php:1-1017A bash script that simulates the full exploitation flow of CVE-2019-14206, including path construction analysis and a simulated file deletion on a local test file.
docker-test.sh:1-220A bash script that verifies the test environment, analyzes the vulnerable code, simulates the exploit, and validates the associated Nuclei template without requiring a running PHP server.
docker-test-full.sh:1-235A bash script that sets up a local test environment, explains the vulnerability, simulates the path construction and file deletion, and verifies the Nuclei template.
vulnerability-demo.sh:1-203A bash script that creates a local test environment with the necessary files and directories to test the exploit without Docker.
local-test.sh:1-95A bash script that demonstrates searching for potential vulnerable targets and running the Nuclei template against a sample target list.
real-target-test.sh:1-104A bash script that attempts to download the real vulnerable plugin from WordPress SVN and sets up a Docker test environment with the necessary files.
setup-real-plugin.sh:1-196A bash script that tests the LFI and arbitrary file deletion vulnerabilities against a running PHP server.
test-exploit.sh:1-56A PHP script that explains the vulnerability, shows the exploit request structure, and simulates detection without performing actual exploitation.
demo.php:1-80A PHP script that sets up a test environment, simulates the vulnerable code execution, and demonstrates the file deletion exploit.
vulnerability-demo.php:1-124A PHP script that simulates a WordPress environment, includes the vulnerable script, and checks if a target file is deleted.
docker-test/exploit-test.php:1-57A Python HTTP server that simulates the vulnerable adaptive-images-script.php endpoint, demonstrating path traversal and vulnerability confirmation.
docker-test/test-server.py:1-105Supported by supplied evidence
The entire unit is dedicated to demonstrating CVE-2019-14206. The README, scripts, and the mounted vulnerable plugin script all explicitly reference this CVE and describe the arbitrary file deletion vulnerability in the Adaptive Images plugin.
README.md:1-5plugin/adaptive-images-script.php:1-1017README.md:1-572docker-compose.yml:14docker-compose.yml:7README.md:1-572README.md:1-572docker-test.sh:1-220docker-test.sh:1-220All visible behavior is directed at the lab's own target (the WordPress container). The scripts simulate or demonstrate the exploit against local test files within the lab environment. There is no evidence of host compromise, external communication, credential theft, or any action beyond the documented vulnerability exercise.
docker-test.sh:1-220docker-test-full.sh:1-235This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
Packet coverage: 1 binary file not inspected
Nevma Adaptive Images plugin before 0.6.67 for WordPress contains an arbitrary file deletion caused by unsanitized input in adaptive-images-script.php, letting remote attackers delete arbitrary files, exploit requires sending specific request parameters.
Remote attackers can delete arbitrary files on the server, potentially causing data loss and service disruption.
Update to version 0.6.67 or later.
Source: ProjectDiscovery