CVE-2015-4694 Scanner
CVE-2015-4694 scanner - Directory Traversal vulnerability in Zip Attachments plugin for WordPress
Short Info
Level
High
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
1 month 2 days
Scan only one
URL
Toolbox
-
The Zip Attachments plugin for WordPress is a tool used to simplify the process of adding downloadable files to a WordPress website. With this plugin, files can be compressed into a single ZIP file and attached to a page or post. This makes it easier for visitors to access and download the files they need.
One major vulnerability found in the plugin is identified as CVE-2015-4694. This vulnerability allows remote attackers to access arbitrary files through a directory traversal technique. Specifically, the vulnerability exists in the download.php file, which can be exploited through a '..' (dot dot) in the za_file parameter. This allows attackers to access files beyond the plugin's intended scope and potentially gain access to sensitive information.
If left unchecked, this vulnerability can lead to a wide range of consequences. Attackers can gain access to sensitive information stored in files that are otherwise hidden from public view. This can include personal information, financial information, and other sensitive data that can be used for malicious purposes. In some cases, attackers may even be able to gain full control over a website or server, further escalating the scope and severity of the attack.
Thanks to the pro features of the s4e.io platform, readers can easily and quickly learn about vulnerabilities in their digital assets. With advanced scanning capabilities and automatic alerts, the platform helps users stay on top of potential threats and take proactive measures to protect their websites and data. By partnering with s4e.io, it's possible to stay one step ahead of even the most advanced and sophisticated attacks.
REFERENCES
- http://www.openwall.com/lists/oss-security/2015/06/12/4
- http://www.openwall.com/lists/oss-security/2015/06/21/2
- http://www.securityfocus.com/bid/75211
- http://www.vapid.dhs.org/advisory.php?v=126
- https://wordpress.org/plugins/zip-attachments/changelog/
- https://wordpress.org/support/topic/zip-attachments-wordpress-plugin-v114-arbitrary-file-download-vulnerability?replies=1
- https://wpvulndb.com/vulnerabilities/8047
