This host is installed with Wordpress DukaPress and is prone to directory traversal vulnerability.

Successful exploitation will allow remote attackers to download arbitrary files. Impact Level: Application

Upgrade to version 2.5.4 or higher, For updates refer to https://wordpress.org/plugins/dukapress

Flaw is due to the dp_img_resize function in the php/dp-functions.php script not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') via the 'src' parameter that contains '..' to lib/dp_image.php.

Wordpress DukaPress plugin before 2.5.4

Send a crafted data via HTTP GET request and check whether it is able to read arbitrary files or not.

• http://www.exploit-db.com/exploits/35346
• http://www.osvdb.org/115130
• http://xforce.iss.net/xforce/xfdb/98943

---

Updated on 2015-03-25