CVE-2020-36705 Scanner

The Adning Advertising plugin is a popular tool for WordPress used by web administrators and marketers to manage and display advertisements on websites. Its extensive customization capabilities allow marketers to reach diverse audiences. Website owners employ this plugin to drive monetization through advertisements, enhancing the site's engagement and revenue strategies. The plugin is particularly favored by small businesses for its ease of use and integration capabilities with existing web frameworks. It offers various ad formats, including banners and pop-ups, making it versatile for different marketing needs. Furthermore, the plugin's compatibility with WordPress makes it an accessible solution for non-technical users.

The vulnerability in question is an Arbitrary File Upload vulnerability, specifically affecting versions up to and including 1.5.5 of the Adning Advertising plugin. This type of vulnerability allows attackers to upload files to a system without the proper validation of file types, potentially leading to further exploitation. Arbitrary File Upload vulnerabilities pose a significant risk as they can be leveraged to install malicious scripts or files onto the server. The root cause in this case is the lack of appropriate file type validation in the _ning_upload_image function within the plugin code. Consequently, this vulnerability requires urgent attention due to the potential for remote code execution if malicious files are uploaded.

Technically, the vulnerability arises because the Adning Advertising plugin's _ning_upload_image function fails to validate the file type before allowing an upload. This flaw means an attacker could potentially upload files with malicious payloads, such as scripts capable of executing code on the server. The end point in question is the image upload functionality exposed by the plugin, which lacks adequate security checks and sanitization. This vulnerability is exacerbated by conditions that do not require the attacker to authenticate before uploading files, increasing the risk of exploitation. Given that many WordPress sites operate with this plugin, exploitations can propagate quickly and cause extensive damage.

If exploited, the Arbitrary File Upload vulnerability can have severe consequences for the affected WordPress sites. Attackers may upload scripts that execute malicious code, leading to unauthorized access or control of the server. This could result in data breaches, compromising sensitive user information or intellectual property stored on the server. Additionally, it could allow attackers to pivot within the network to target other critical assets. Moreover, the affected website could be used to host malicious content or distribute malware, damaging its reputation and causing financial losses. These outcomes highlight the importance of addressing and remediating the vulnerability swiftly.

REFERENCES

• https://blog.nintechnet.com/critical-vulnerability-in-adning-advertising-plugin-actively-exploited-in-the-wild/
• https://codecanyon.net/item/wp-pro-advertising-system-all-in-one-ad-manager/269693
• https://wpscan.com/vulnerability/e9873fe3-fc06-4a52-aa32-6922cab7830c
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4a263b74-e9ae-4fd2-be9b-9b8e9eee5982?source=cve