[FD] Local File Include vulnerability in GD bbPress Attachments allows attackers to include arbitrary PHP files (WordPress plugin)

[dxw Security <security@xxxxxxx>]

Details
================
Software: GD bbPress Attachments
Version: 2.1
Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/
Advisory report: 
https://security.dxw.com/advisories/local-file-include-vulnerability-in-gd-bbpress-attachments-allows-attackers-to-include-arbitrary-php-files/
CVE: Awaiting assignment
CVSS: 4.3 (Medium; AV:N/AC:M/Au:N/C:N/I:N/A:P)

Description
================
Local File Include vulnerability in GD bbPress Attachments allows attackers to 
include arbitrary PHP files

Vulnerability
================
An attacker who is an admin can easily include any .php file on the server.
An attacker who can get an admin to follow a link they control will also be 
able to include that PHP file. It is easy to make these links very convincing.
They could exploit this to attempt to exhaust the server’s resources by 
including the file that includes the arbitrary file in an infinite loop.
If they’re additionally able to upload arbitrary PHP files (via an admin 
account or some other vulnerability) they’ll be able to run arbitrary code on 
the server.
 

Proof of concept
================
Visit this URL to cause an infinite loop:
http://localhost/wp-admin/edit.php?post_type=forum&page=gdbbpress_attachments&tab=../panels

Mitigations
================
Upgrade to version 2.2 or later

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our 
disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@xxxxxxx to acknowledge this report if you 
received it via a third party (for example, plugins@xxxxxxxxxxxxx) as they 
generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this 
report with 14 days.

Timeline
================

2015-02-25: Discovered
2015-07-01: Reported to vendor via email form on 
https://www.dev4press.com/contact/
2015-07-01: Requested CVE
2015-07-01: Vendor responded
2015-07-09: Vendor confirmed fix
2015-07-09: Published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.
          


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/