CVE-2017-20248

Vulnerability

Apptha Slider Gallery version 1.0 contains a path traversal vulnerability. This vulnerability exists in the asgallDownload.php script and can be exploited by manipulating the imgname parameter to access files outside the intended directory [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a crafted request to asgallDownload.php. By using directory traversal sequences such as ../ within the imgname parameter, an attacker can navigate the file system and download arbitrary files [1, 2]. For example, a request like http://localhost/[PLUGIN_PATH]/asgallDownload.php?imgname=../../../wp-load.php could be used [2].

Impact

Successful exploitation allows an unauthenticated attacker to download arbitrary files from the server. This could lead to the disclosure of sensitive information, depending on the files accessed [1].

Mitigation

Apptha Slider Gallery version 1.0 is affected. A fixed version is not explicitly mentioned in the available references, but the vendor is Apptha [1, 2]. It is recommended to update to a patched version once it becomes available or consider removing the plugin if a patch is not provided.