Event Manager for WooCommerce < 4.2.2 – Authenticated (Contributor+) Local File Inclusion | CVE 2024-43138

Description

The Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the 'mep_event_template' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Proof of Concept

Step-1: Go to the Add Events page (wp-admin/post-new.php?post_type=mep_events).

Step-2: Enter the Title as "Local File Inclusion" or other title as per your choice, as well as enter description.

Step-3: Publish this new event and capture the request in the burp suite.

Step-4: Send this request to Burp repeater tab, and find the body parameter named "mep_event_template".

Step-5: Change the value of the above mentioned parameter to "../../../../../../../../../../etc/passwd" or other LFI payload.
 
Step-6: When you send the request, the successful response will show an array containing the post object otherwise the failed response will show the empty array.

Step-7: Once you got the success reponse, visit the URL "events/local-file-inclusion/" or "/events/<title given in Step-2>", and you will see the contents of the local files that you want to access.