0

When I am accessing my Wordpress website, for example:

https://example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

it's returning a page containing zero.

Is this a vulnerability? Can someone help on this issue? If this is a vulnerability, how to protect against it?

I am getting lot of logs for particular website."example.com/wp-admin/…; i dont know what the intented output but when i tried accessing the url i got "0".

  • Containing zero what? Zero bytes? I wouldn't suggest this is a vulnerability but a plug-in bug. – schroeder Feb 9 '16 at 17:29
  • You also don't tell us what the expected result is, or if there is anything unusual with the HTTP request. Please edit your question to add more context. – schroeder Feb 9 '16 at 17:29
  • @schroeder iam getting message like this "0". – MS Guy Feb 9 '16 at 17:34
  • @schroeder I am getting lot of logs for particular website."example.com/wp-admin/…" i dont know what the intented output but when i tried accessing the url i got "0"... – MS Guy Feb 9 '16 at 17:38
  • ok - hold on - the URL request is one you found in the logs, and it is unexpected? You need to include these things in your question! It looks like someone is trying to access your wp-config.php file by using the image slider plug-in. Update your plug-ins to make sure any vulnerabilities are patched, or change to plug-ins that do not have published vulnerabilities. – schroeder Feb 9 '16 at 17:44
2

Since you never know, when new vulnerability will be found, my suggestion for you is to install mod_security on server side.

It's not 100% security, but at least, it will make harder for hacker to perform attacks such as LFI, RFI etc.

1

The URL in question is part of a Local File Inclusion attack targeting the Slider Revolution plugin. The objective of this particular attack is to make the wp-config.php downloadable in a raw, non processed format. Doing so would give the attacker your database credentials as well as any other stored credentials such as FTP and mail server login information. Since your server is returning a "0" and not a download stream or echo of your configuration it appears you are using a patched version of this plugin.

Edit: It is also possible you don't even have this plugin installed at all. As the file it is requesting exists on every WP install. But the request it is making would return false if you do not have this plugin installed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.