← Advisories

WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Deletion Exploit

Medium
Advisory ID
ZSL-2015-5240
Release Date
14 April 2015
Vendor
Miwisoft LLC - http://www.miwisoft.com
Affected Version
1.0.5
CVE
N/A
Tested On
Apache 2.4.10 (Win32), PHP 5.6.3, MySQL 5.6.21
Summary

MiwoFTP is a smart, fast and lightweight file manager plugin that operates from the back-end of WordPress.

Description

Input passed to the 'selitems[]' parameter is not properly sanitised before being used to delete files. This can be exploited to delete files with the permissions of the web server using directory traversal sequences passed within the affected POST parameter.

Proof of Concept
miwoftp_del.txtTXT
Disclosure Timeline
24.03.2015Vulnerability discovered.
25.03.2015Vendor contacted.
25.03.2015Vendor responds asking more details.
26.03.2015Sent details to the vendor.
27.03.2015Vendor forwarded details to developers.
30.03.2015Vendor confirms vulnerability scheduling patch by end of week.
31.03.2015Replied to the vendor.
09.04.2015Asked vendor for status update.
12.04.2015No reply from the vendor.
13.04.2015Asked vendor for status update.
13.04.2015Vendor replies promising patch by end of week.
14.04.2015Vendor releases version 1.0.6 to address these issues.
14.04.2015Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
[1]http://miwisoft.com/wordpress-plugins/miwoftp-wordpress-file-manager#changelog
[2]http://www.exploit-db.com/exploits/36761/
[3]http://cxsecurity.com/issue/WLB-2015040070
[4]http://packetstormsecurity.com/files/131434
[5]http://osvdb.org/show/osvdb/120797
[6]https://exchange.xforce.ibmcloud.com/vulnerabilities/102402
[7]https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/miwoftp/miwoftp-106-cross-site-request-forgery-to-arbitrary-file-deletion
Changelog
14.04.2015Initial release
16.04.2015Added reference [2], [3], [4], [5] and [6]
16.12.2022Added reference [7]