CVE Request - LFI/Path Traversal in NextGen Gallery WordPress Plugin.

[Dis close <disclose () cybersecurityworks com>]

Hi List:


We are requesting CVE for the below mentioned security issue in NextGen
Gallery Plugin:


Plugin Details:
==============
Plugin Name: NextGen Gallery
Version: 2.1.7
Homepage: https://wordpress.org/plugins/nextgen-gallery/



Description
===============
NextGEN Gallery is most popular *WordPress Gallery Plugin *with over 13
millions downloads.

Vulnerability
===============
The plugin fails to validate user input in one of the variables, which
allows a  log-in user to access system files and other unauthorized files
on the server.

POC Video Link: https://www.youtube.com/watch?v=KkPVMxubUis


Proof of Concept
================

Accessing the POST request http://localhost/wordpress/?photocrati_ajax=1
and modifying the *dir* variable with ../../../ input user can traverse
file system and access files even outside the application directory.


Disclosure Timeline
==================

17-02-2015: Reported to WP Plugins
18-02-2015: Acknowledged by WP Plugin, saying that vendor will be informed.
But till now no response from WP plugin or vendor.


Discovered by ( Please provide credit to following)
=====================================

Sathish Kumar
Cyber Security Works Pvt Ltd.


----------
Cheers !!!

Team CSW