关键漏洞信息 EDB-ID: 44340 CVE: 2018-7422 Author: Nicolas Buzy-Debat Type: WEBAPPS Platform: PHP Date: 2018-03-23 Vulnerable App: Site Editor Wordpress Plugin 1.1.1 Vulnerability: Local File Inclusion CVE Description A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php. Technical Details The value of the parameter is used for including a file with PHP’s . This parameter can be controlled by an attacker and is not properly sanitized. Proof of Concept Solution No fix available yet. Timeline 03/01/2018: Author contacted through siteeditor.org's contact form; no reply 16/01/2018: Issue report filed on the public GitHub page with no technical details 18/01/2018: Author replies and said he replied to our e-mail 8 days ago (could not find the aforementioned e-mail at all); author sends us "another" e-mail 19/01/2018: Report sent; author says he will fix this issue "very soon" 31/01/2018: Vendor contacted to ask about an approximate release date and if he needs us to postpone the disclosure; no reply 14/02/2018: WP Plugins team contacted; no reply 06/03/2018: Vendor contacted; no reply 07/03/2018: Vendor contacted; no reply 15/03/2018: Public disclosure Credits Vulnerability discovered by Nicolas Buzy-Debat working at Orange Cyberdefense Singapore (CERT-LEXSI).