CVE-2015-10105: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function valid_js_identifier of the file ip_blacklist_cloud.php of the component CSV File Import. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. Upgrading to version 3.43 is able to address this issue. The identifier of the patch is 6e6fe8c6fda7cbc252eef083105e08d759c07312. It is recommended to upgrade the affected component. The identifier VDB-227757 was assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2023-05-01T02:15Z
Repository: https://github.com/wp-plugins/ip-blacklist-cloud
Language: Other
Files changed: ip_blacklist_cloud.php, readme.txt
Commit date: 2015-03-07 12:10:54 +0000
Commit message: fixed CSV file import vulnerability - version 3.43

git-svn-id: https://plugins.svn.wordpress.org/ip-blacklist-cloud/trunk@1107588 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/ip_blacklist_cloud.php b/ip_blacklist_cloud.php
index f5272b8..78e5311 100644
--- a/ip_blacklist_cloud.php
+++ b/ip_blacklist_cloud.php
@@ -1,11 +1,11 @@
 <?php
 /*
 Plugin Name: IP Blacklist Cloud
 Plugin URI: http://wordpress.org/extend/plugins/ip-blacklist-cloud/
 Description: Blacklist IP Addresses from visiting your WordPress website and block usernames from spamming. View details of all failed login attempts.
-Version: 3.42
+Version: 3.43
 Author: Adeel Ahmed
 Author URI: http://www.ip-finder.me/
 */
 
 
@@ -1879,30 +1879,51 @@ $link="http://www.ip-finder.me/wp-content/themes/ipfinder/blacklist_delete.php?I
 		//------end Export-----
 
 		//-----Import Database-----
 		if($_REQUEST['action']=="importCSVIPCloud")
 		{
-			if(current_user_can( 'manage_options' ) && $_REQUEST['filename'])
+			if(current_user_can( 'manage_options' ) && isset($_REQUEST['filename']))
 			{
 				$js_url =get_bloginfo('template_directory');
 				$upload_d = wp_upload_dir();
 				$upload_url=$upload_d['baseurl'];
 				$upload_dir=$upload_d['basedir'];
-				$filename= $upload_dir."/ipblc_csv/".$_REQUEST['filename'];
+				$file_req=$_REQUEST['filename'];
+
+				//---remove ../ or ./ from direct access---
+
+				$file_req=str_replace("../","",$file_req);
+				$file_req=str_replace("./","",$file_req);
+
+				$filename= $upload_dir."/ipblc_csv/".$file_req;
+
+
 				//echo "file: $filename<BR>";
+
+				$exp=explode(".",$filename);
+				$ext=strtolower($exp[count($exp)-1]);
 				$row = 1;
-				if (($handle = fopen("$filename", "r")) !== FALSE)
-				{
-					$AllData=array();
-					while (($data = fgetcsv($handle, 5242880, ",")) !== FALSE)
+				$file_type=filetype($filename);
+				
+				if($ext=="csv" && $file_type=="file")
+				{ 
+					if (($handle = fopen("$filename", "r")) !== FALSE)
+					{
+						$AllData=array();
+						while (($data = fgetcsv($handle, 5242880, ",")) !== FALSE)
+						{
+							$field=$data[0];
+							$value=$data[1];
+							$AllData[]=array("$field"=>$value);
+						}
+						fclose($handle);
+						echo json_encode($AllData);
+					}
+					else
 					{
-						$field=$data[0];
-						$value=$data[1];
-						$AllData[]=array("$field"=>$value);
+						echo "-1";
 					}
-					fclose($handle);
-					echo json_encode($AllData);
 				}
 				else
 				{
 					echo "-1";
 				}
diff --git a/readme.txt b/readme.txt
index 32e1c2a..d8af7ad 100644
--- a/readme.txt
+++ b/readme.txt
@@ -2,11 +2,11 @@
 Contributors: ad33lx
 Donate link: 
 Tags: comments, spam, IP, blacklist, cloud, IP cloud, block, spamming, secure, failed login, hack attempt, auto block login
 Requires at least: 3.3
 Tested up to: 4.1.1
-Stable tag: 3.42
+Stable tag: 3.43
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 
 
@@ -89,10 +89,13 @@ You can test this plugin before downloading and installing on demo server.
 http://demo.ip-finder.me/demo-details/
 
 
 == Changelog ==
 
+= 3.43 =
+* Quick Fix - Fixed CSV import vulnerability found by g0blin
+
 = 3.42 =
 * Quick Fix - Fixed mysql_real_escape_string() warning
 
 = 3.4.1 =
 * Fixed security exploits found by Mika Epstein

Vulnerable code: Version: 3.42
			if(current_user_can( 'manage_options' ) && $_REQUEST['filename'])
				$filename= $upload_dir."/ipblc_csv/".$_REQUEST['filename'];
				if (($handle = fopen("$filename", "r")) !== FALSE)
				{
					$AllData=array();
					while (($data = fgetcsv($handle, 5242880, ",")) !== FALSE)
						$field=$data[0];
						$value=$data[1];
						$AllData[]=array("$field"=>$value);
					fclose($handle);
					echo json_encode($AllData);
Stable tag: 3.42
Fixed code: Version: 3.43
			if(current_user_can( 'manage_options' ) && isset($_REQUEST['filename']))
				$file_req=$_REQUEST['filename'];

				//---remove ../ or ./ from direct access---

				$file_req=str_replace("../","",$file_req);
				$file_req=str_replace("./","",$file_req);

				$filename= $upload_dir."/ipblc_csv/".$file_req;



				$exp=explode(".",$filename);
				$ext=strtolower($exp[count($exp)-1]);
				$file_type=filetype($filename);
				
				if($ext=="csv" && $file_type=="file")
				{ 
					if (($handle = fopen("$filename", "r")) !== FALSE)
					{
						$AllData=array();
						while (($data = fgetcsv($handle, 5242880, ",")) !== FALSE)
						{
							$field=$data[0];
							$value=$data[1];
							$AllData[]=array("$field"=>$value);
						}
						fclose($handle);
						echo json_encode($AllData);
					}
					else
						echo "-1";
Stable tag: 3.43
= 3.43 =
* Quick Fix - Fixed CSV import vulnerability found by g0blin