WordPress Plugin Search Meter 2.13.2 – CSV injection

• Exploit Database
• 100 阅读

• 作者： Daniel Monzón
  日期： 2020-03-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48197/

• # Exploit Title: WordPress Plugin Search Meter 2.13.2 - CSV Injection
  # Google Dork: N/A
  # Date: 2020-03-10
  # Exploit Author: Daniel Monzón (stark0de)
  # Vendor Homepage: https://thunderguy.com/semicolon/
  # Software Link: https://downloads.wordpress.org/plugin/search-meter.2.13.2.zip
  # Version: 2.13.2
  # Tested on: Windows 7 x86 SP1
  # CVE : N/A
  
  There is a CSV injection vulnerability in the Export function of the Search Meter plugin version 
  
  1) First we introduce the payload in the search bar in WordPress
  
  =cmd|' /C notepad'!'A1'
  
  
  2) Then we go to http://127.0.0.1/wordpress/wp-admin/index.php?page=search-meter%2Fadmin.php and export the CSV file
  
  
  3) After that we open the file in Excel, and import data from an external file, using comma as separator
  
  
  4) Payload gets executed
  
  
  Tested on Windows 7 Pro SP1 32-bit, WordPress 5.3.2 and Excel 2016
  

  Python

  Copy