WordPress teachPress Plugin "root" Two Local File Inclusion Vulnerabilities
Description
Two vulnerabilities have been discovered in the teachPress plugin for WordPress, which can be exploited by malicious people to disclose potentially sensitive information.
1) Input passed via the "root" parameter to wp-content/plugins/teachpress/feed.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal sequences and URL-encoded NULL bytes.
2) Input passed via the "root" parameter to wp-content/plugins/teachpress/export.php (when "lvs_ID" and "type" are set) is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal sequences and URL-encoded NULL bytes.
Successful exploitation requires that "register_globals" is enabled and "magic_quotes_gpc" is disabled.
The vulnerabilities are confirmed in version 2.3.2. Prior versions may also be affected.
