nextgen-gallery-pro-error-log: WordPress NextGEN Gallery Pro - Error Log Disclosure

id: nextgen-gallery-pro-error-log

info:
  name: WordPress NextGEN Gallery Pro - Error Log Disclosure
  author: ritikchaddha
  severity: medium
  description: |
    The NextGEN Gallery Pro plugin for WordPress may expose debug/error log files that contain sensitive information including file paths, database queries, and potentially credentials. These log files are accessible without authentication.
  reference:
    - https://wpscan.com/plugin/nextgen-gallery/
    - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-nextgen-gallery-wordpress-gallery-information-disclosure-1-9-11/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-532
  metadata:
    verified: true
    fofa-query: body="/plugins/nextgen-gallery-pro"
  tags: wordpress,wp,wp-plugin,nextgen-gallery-pro,log,exposure,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    matchers:
      - type: word
        part: body
        words:
          - "nextgen"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-content/debug.log"

    matchers:
      - type: dsl
        dsl:
          - 'regex("[[0-9]{2}-[a-zA-Z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2} [A-Z]{3}] PHP", body)'
          - 'contains_any(body, "PHP Warning:", "PHP Notice:", "Undefined array", "Undefined variable")'
          - 'status_code == 200'
        condition: and
# digest: 480a00453043021f6b97198613d60ba3db217cd091dc8716150b45da5ef65aa5ba2f7d93c584be02201553e85e807b91f3d0491cfca6561d4d08ccde173527f59b0071b042f2db70ab:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.