Description
WordPress Plugin Spicy Blogroll is prone to a local file include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process; this may aid in launching further attacks. WordPress Plugin Spicy Blogroll version 1.0.0 is vulnerable; other versions may also be affected.
Remediation
Edit the source code to ensure that input is properly sanitised or disable the plugin until a fix is available
References
https://www.exploit-db.com/exploits/26804/
http://1337day.com/exploit/20994
http://packetstormsecurity.com/files/122396/WordPress-Spicy-Blogroll-Local-File-Inclusion.html
Related Vulnerabilities
WordPress Plugin FoxyShop Cross-Site Scripting (4.6)
ownCloud CVE-2013-0302 Vulnerability (CVE-2013-0302)
WordPress Plugin Uncanny Toolkit for LearnDash Cross-Site Request Forgery (3.6.4.1)
EspoCRM Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-7986)
Apache HTTP Server Out-of-bounds Read Vulnerability (CVE-2023-31122)