CVE-2018-25324: Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath
Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wpabspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wpabspath values to simplefields.php to include files like /etc/passwd or inject PHP code into Apache logs for remote code execution when allowurlinclude is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Simple Fieldsto a version that resolves this vulnerability.Fixed in 0.3.5 - Configuration
Disable allow_url_include to prevent remote file inclusion/inclusion of attacker-controlled wp_abspath values that can lead to remote code execution via injected content in Apache logs.
PHP allow_url_include = disabled - Compensating control
Ensure the WordPress plugin Simple Fields is not reachable/exposed to unauthenticated users while remediation is applied (e.g., restrict access to the affected endpoint/path if possible at the web server or via ACL/WAF).
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25324?
CVE-2018-25324 is considered a medium severity vulnerability due to its potential for local file inclusion that can expose sensitive files.
How do I fix CVE-2018-25324?
To fix CVE-2018-25324, update the Simple Fields plugin to a version above 0.3.5 and ensure your PHP version is 5.3.4 or later.
Who is affected by CVE-2018-25324?
Users of the Simple Fields WordPress plugin version 0.2 to 0.3.5 on PHP versions prior to 5.3.4 are affected by CVE-2018-25324.
What type of attack is possible with CVE-2018-25324?
CVE-2018-25324 allows unauthenticated attackers to perform local file inclusion attacks that can lead to unauthorized file access.
What versions of the software are impacted by CVE-2018-25324?
CVE-2018-25324 impacts Simple Fields plugin versions 0.2 through 0.3.5 and PHP versions prior to 5.3.4.