CVE-2022-1392
📋 TL;DR
This vulnerability in the Videos sync PDF WordPress plugin allows attackers to read arbitrary files on the server through Local File Inclusion (LFI). Attackers can exploit this by manipulating the 'p' parameter to include sensitive system files. All WordPress sites using the vulnerable plugin versions are affected.
💻 Affected Systems
- Videos sync PDF WordPress plugin
📦 What is this software?
Videos Sync Pdf by Commoninja
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through reading sensitive files like /etc/passwd, database credentials, or using PHP wrappers to execute arbitrary code.
Likely Case
Information disclosure of sensitive files, potentially leading to credential theft and further system compromise.
If Mitigated
Limited impact if proper file permissions and web server configurations restrict access to sensitive directories.
🎯 Exploit Status
Simple parameter manipulation required. Public exploit code exists in Packet Storm references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.5 or later
Vendor Advisory: https://wpscan.com/vulnerability/fe3da8c1-ae21-4b70-b3f5-a7d014aa3815
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find 'Videos sync PDF' plugin. 4. Update to version 1.7.5 or later. 5. Alternatively, deactivate and delete the plugin if not needed.
🔧 Temporary Workarounds
Disable vulnerable plugin
allDeactivate the Videos sync PDF plugin to immediately remove the vulnerability.
wp plugin deactivate videos-sync-pdf
Web Application Firewall rule
allBlock requests containing suspicious file paths in the p parameter.
ModSecurity rule: SecRule ARGS:p "\.\./" "id:1001,phase:2,deny,status:403,msg:'LFI attempt'"
WAF configuration to block ../ patterns in URL parameters
🧯 If You Can't Patch
- Implement strict file permissions to limit readable directories
- Use web server configuration to restrict file inclusion to specific directories
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for plugin version. If Videos sync PDF plugin is installed and version is 1.7.4 or earlier, the system is vulnerable.Check Version:
wp plugin list --name='videos-sync-pdf' --field=versionVerify Fix Applied:
Verify plugin version is 1.7.5 or later in WordPress admin panel. Test the vulnerable endpoint with LFI payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'p' parameter containing '../' patterns
- Access to sensitive file paths via web requests
- 404 errors for unusual file paths
Network Indicators:
- HTTP GET requests with file path traversal in parameters
- Unusual file extensions in URL parameters
SIEM Query:
source="web_logs" AND (url="*p=*../*" OR url="*p=*/etc/*" OR url="*p=*/proc/*")