Issuu Panel Plugin: Arbitrary File Inclusion (CVE-2016-20101)

The Issuu Panel plugin for WordPress, specifically versions prior to 1.6.6, contains a critical vulnerability related to improper input validation in the file 'menu/documento/requests/ajax-docs.php'. The plugin fails to sanitize the 'abspath' parameter before passing it to a PHP 'require()' function. This flaw permits unauthenticated remote attackers to perform Local File Inclusion (LFI) or Remote File Inclusion (RFI) attacks. By manipulating the 'abspath' parameter in a crafted GET request, an attacker can force the web server to execute arbitrary PHP code or read sensitive local files from the filesystem. Exploitation of this vulnerability has been observed in the wild since October 2023, necessitating immediate patching for all WordPress instances utilizing this plugin.

Attack Chain

1. Attacker performs reconnaissance to identify WordPress installations running the Issuu Panel plugin.
2. Attacker crafts a malicious GET request targeting the vulnerable file '/menu/documento/requests/ajax-docs.php'.
3. Attacker injects a malicious file path or remote URL into the 'abspath' parameter of the HTTP request.
4. The web server process receives the request and processes the PHP file 'ajax-docs.php'.
5. The vulnerable code within the plugin passes the attacker-supplied 'abspath' value directly to the 'require()' function.
6. The PHP interpreter executes the code located at the malicious URL or includes the local file specified by the attacker.
7. Attacker gains Remote Code Execution (RCE) on the underlying web server or exfiltrates sensitive server-side files.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code with the privileges of the web server user (e.g., www-data) or read sensitive configuration files (e.g., wp-config.php), leading to full site compromise, data exfiltration, and potential lateral movement within the hosting environment.

Recommendation

• Update the Issuu Panel plugin for WordPress to version 1.6.6 or later immediately to patch CVE-2016-20101.
• Monitor web server access logs for anomalous GET requests containing suspicious 'abspath' parameters targeting 'ajax-docs.php'.
• Deploy the provided Sigma rule to detect attempts to exploit this file inclusion vulnerability via the web application layer.