This host is installed with Wordpress Tera Charts and is prone to multiple directory traversal vulnerability.

Successful exploitation will allow remote attackers to download arbitrary files. Impact Level: Application

Upgrade to version 1.0 or higher, For updates refer https://wordpress.org/plugins/tera-charts

Flaw is due to the 'charts/treemap.php' and 'charts/zoomabletreemap.php' scripts are not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') via the 'fn' parameter.

Wordpress Tera Charts plugin version 0.1

Send a crafted data via HTTP GET request and check whether it is able to read arbitrary files or not.

• http://www.osvdb.org/109028
• http://www.osvdb.org/109029
• https://codevigilant.com/disclosure/wp-plugin-tera-chart-local-file-inclusion

---

Updated on 2015-03-25