Dear users,
On my website we have a responsible disclosure to attract ethical hackers to report vulnerability’s to us.
Today I got this mail with a possible vulnerability.
– Is this a real risk?
– If yes , is this something that Tagdiv can fix in a next release?
Original mail:
—————
DeaR ,
Sir / Madam,
<my site> Support Team
My Name Is <name ethical hacker> From <country>
I Am Security Researcher’s
I Am Founded Path Disclosure Vulnerability (FPD)
Description:
Full Path Disclosure (FPD) vulnerability enable the attacker to see the path to the webroot/file. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view.
The Vulnerable Domain(URL) Is :-
https://www.<mysite>.beer/wp-content/themes/Newsmag/
Attack details: (impact)
With the Inspect Elemenr of browser , we change the value in the form of any field of the plugin by addin the Empty array []
that’s all and thank you so much
*# Everything is shown in the POC in a quick way
Images:
———-
https://ibb.co/NW34zKg
and
https://ibb.co/j8Kg24C
Hi,
TO fix this problem, please add this code
if (!defined('ABSPATH')) exit;
in wp-content/themes/Newsmag/index.php -> https://i.imgur.com/pxmGyfB.png -> https://i.imgur.com/5m98xIo.png
-> https://i.imgur.com/ckan5Ek.png -> https://i.imgur.com/NG9NVTX.png
This fix will be add in the coming update!
Thank you for letting us know this problem!
Great thanks for the fast Support Calin!
P.s Is it possible to give credit to “Shivam Khambe (from India)” in the next release notes for finding this issue.
Krs
Dieter
Hi,
I made this suggestion to our developer.
Thanks again and have a nice day!
