CVE-2012-6652
📋 TL;DR
This vulnerability allows remote attackers to perform directory traversal via the pageflipbook_language parameter in the Page Flip Book WordPress plugin. Attackers can include and execute arbitrary local files on the server, potentially leading to remote code execution. WordPress sites using the vulnerable plugin are affected.
💻 Affected Systems
- WordPress Page Flip Book Plugin (wppageflip)
📦 What is this software?
Page Flip Book by Page Flip Book Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and website defacement.
Likely Case
Local file inclusion allowing attackers to read sensitive files like configuration files, potentially leading to credential theft.
If Mitigated
Limited impact if proper file permissions and web server configurations restrict file access.
🎯 Exploit Status
Simple directory traversal attack requiring minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - plugin appears abandoned
Vendor Advisory: https://wordpress.org/support/topic/pageflipbook-pageflipbook_language-parameter-local-file-inclusion/
Restart Required: No
Instructions:
1. Remove the Page Flip Book plugin entirely. 2. Delete all plugin files from wp-content/plugins/wppageflip. 3. Consider alternative page flip plugins.
🔧 Temporary Workarounds
Input Validation
allAdd input validation to restrict pageflipbook_language parameter to allowed values only
Edit pageflipbook.php to validate language parameter against whitelist
Web Server Restrictions
allConfigure web server to block directory traversal attempts
Add mod_security rules or equivalent WAF rules
🧯 If You Can't Patch
- Disable or remove the Page Flip Book plugin immediately
- Implement web application firewall with directory traversal protection
🔍 How to Verify
Check if Vulnerable:
Check if wp-content/plugins/wppageflip directory exists and contains pageflipbook.phpCheck Version:
Not applicable - plugin appears abandonedVerify Fix Applied:
Confirm wppageflip directory is removed from wp-content/plugins📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '..' or '../' in pageflipbook_language parameter
- Multiple failed attempts to access sensitive files
Network Indicators:
- Unusual file access patterns via pageflipbook.php
SIEM Query:
web.url:*pageflipbook.php* AND web.param:*..*🔗 References
- http://ceriksen.com/2012/07/10/wordpress-a-page-flip-book-plugin-local-file-inclusion-vulnerability/
- https://wordpress.org/support/topic/pageflipbook-pageflipbook_language-parameter-local-file-inclusion/
- https://www.openwall.com/lists/oss-security/2014/07/30/2
- https://www.openwall.com/lists/oss-security/2014/07/31/8
- http://ceriksen.com/2012/07/10/wordpress-a-page-flip-book-plugin-local-file-inclusion-vulnerability/
- https://wordpress.org/support/topic/pageflipbook-pageflipbook_language-parameter-local-file-inclusion/
- https://www.openwall.com/lists/oss-security/2014/07/30/2
- https://www.openwall.com/lists/oss-security/2014/07/31/8
