PT-2019-11530 · WordPress · Article2Pdf

Jsfan · Published 2019-03-27 · Updated 2023-02-28 · CVE-2019-1010257

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: article2pdf Wordpress plugin versions 0.24 through 0.27

Description: An Information Disclosure / Data Modification issue exists in the article2pdf getfile.php file. A URL can be constructed to override the PDF file's path, allowing the download of any PDF file whose path is known and readable to the web server. The file will be deleted after download if the web server has permission to do so. For PHP versions before 5.3, any file can be read by null terminating the string left of the file extension.

Recommendations: For versions 0.24 through 0.27, consider disabling the article2pdf getfile.php file until a patch is available to prevent exploitation. Restrict access to sensitive PDF files to minimize the risk of unauthorized download. Avoid using PHP versions before 5.3, as they are more susceptible to file reading vulnerabilities. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-1010257

Affected Products

Article2Pdf

References · 7

• 🔥 https://packetstormsecurity.com/files/152236/WordPress-article2pdf-0.24-DoS-File-Deletion-Disclosure.html · Exploit
• 🔥 https://seclists.org/bugtraq/2019/Mar/49 · Exploit
• https://osv.dev/vulnerability/CVE-2019-1010257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010257 · Security Note
• https://t.me/cvenotify/45205 · Telegram Post
• https://wpvulndb.com/vulnerabilities/9246 · Note
• https://wordpress.org/support/topic/pdf-download-path-improperly-sanitised · Note