WordPress – KenBurner Slider Local File Inclusion (LFI)

Home » Blog » WordPress – KenBurner Slider Local File Inclusion (LFI)

Description

Kayran has detected that you’re using a Responsive KenBurner Slider WordPress Plugin.
This local file inclusion (LFI) vulnerability appeared due to a failure to properly sanitize user-supplied inputs to the ‘img’ parameter of the ‘image_view.class.php’ script.

By exploiting this vulnerability, attackers can download any file they please, even your wp-config.php file.
By doing so, he can steal the database’s credentials, which then allows him to initiate attacks against the website via the database.

Severity/Score

Average Score – 5.0 Medium

Recommendation

To deal with it, upgrade this vulnerable KenBurner Slider WordPress Plugin to version 1.8, which is the version that this vulnerability got fixed.

References

https://arbitrary321.rssing.com/chan-37141670/latest.php

https://cwe.mitre.org/data/definitions/22.html

< Return to all Vulnerabilities

Incident Response

Quickly! – Incident Response – IR

In the field of information security, one of the most important factors is speed. Quickly! Is the way we must respond to each case individually.

What is a CWE ?

Similar to the article written on CVEs, in this article we will answer the questions :What is CWE ? and, what is the difference between

Injection Attacks – You better inject yourself before you get-hacked yourself

Besides the most creative title you’ve ever seen, there are many things we do not like that we can talk about, in this case, we

The average hacker shopping list – the CVE

When i take an X-Rey my doctor sits me down and simply “roast” me with stuff like how un-healthy i am, how i should stop

Zeroed In – Zero-Day Attacks

If you are familiar with programming, you know that Zero ([0]) is usually the starting point of arrays, that is called Zero-based numbering, what does

Horror Movie Villains – Common Malwares

In the field of Information Security (or, Cyber Security), there are many things we need to deal with. Just like the Horror Movie Villains we

WEB APPLICATION VULNERABILITY SCANNER

Links

registered user?