SNS Vulnerability

WordPress Relocate Upload Plugin "abspath" File Inclusion Vulnerability

Description

A vulnerability has been discovered in the Relocate Upload plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.
Input passed via the "abspath" parameter to wp-content/plugins/relocate_upload/relocate-upload.php (when "ru_folder" is set) is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.
The vulnerability is confirmed in version 0.14. Prior versions may also be affected.

Vulnerable Products

Vulnerable Software:
WordPress Relocate Upload Plugin 0.x

Solution

Update to version 0.20.

CVE

CVE-2012-1205

References

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
Misc : Directory traversal - parameter starting with ../	3.2.0
PHP : Remote file inclusion prevention : suspicious root_path parameter found in URL	3.2.0
Directory traversal using ..\..	3.2.0
Directory traversal	3.2.0
PHP : Remote file inclusion prevention : URL found as parameter	3.2.0
Directory traversal backward root folder	3.2.0
Misc : Local File Inclusion - suspicious /etc/passwd found in URL	3.5.0

Risk level

High

Vulnerability First Public Report Date

2012-02-14

Target Type

Server

Possible exploit

Remote