WordPress Plugin Annonces 1.2.0.0 - Remote File Inclusion

WordPress Plugin Annonces 1.2.0.0 - Remote File Inclusion Exploit Title: Annonces Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/annonces Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

WordPress Plugin AllWebMenus 1.1.3 - Remote File Inclusion

WordPress Plugin AllWebMenus 1.1.3 - Remote File Inclusion Exploit Title: Allwebmenus Wordpress Menu Plugin Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/allwebmenus-wordpress-menu-plugin Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software...

WordPress Plugin Disclosure Policy 1.0 - Remote File Inclusion

Exploit Title: Disclosure Policy Plugin Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/disclosure-policy-plugin Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link: http://wordpress.org/extend/plugins/disclosure-policy-plugin/download/...

WordPress Plugin AllWebMenus 1.1.3 - Remote File Inclusion

Exploit Title: Allwebmenus Wordpress Menu Plugin Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/allwebmenus-wordpress-menu-plugin Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

WordPress Plugin Mini Mail Dashboard Widget 1.36 - Remote File Inclusion

Exploit Title: Mini Mail Dashboard Widget Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/mini-mail-dashboard-widget Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

WordPress Plugin Livesig 0.4 - Remote File Inclusion

WordPress Plugin Livesig 0.4 - Remote File Inclusion Exploit Title: Livesig Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/livesig Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link: http://wordpress.org/extend/plugins/livesig/downloa...

WordPress Mini Mail Dashboard Widget 1.36 Remote File Inclusion

Exploit Title: Mini Mail Dashboard Widget Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/mini-mail-dashboard-widget Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

WordPress Disclosure Policy 1.0 Remote File Inclusion

Exploit Title: Disclosure Policy Plugin Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/disclosure-policy-plugin Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link: http://wordpress.org/extend/plugins/disclosure-policy-plugin/download/...

Wordpress Annonces Plugin 1.2.0.0 Remote File Inclusion

Exploit for php platform in category web applications Exploit Title: Annonces Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/annonces Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

Wordpress Mailing List Plugin 1.3.2 Remote File Inclusion

Exploit for php platform in category web applications Exploit Title: Mailing List Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/mailz Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

Wordpress TheCartPress Plugin 1.1.1 Remote File Inclusion

Exploit for php platform in category web applications Exploit Title: Thecartpress Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/thecartpress Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

WordPress Auctions 1.8.8 SQL Injection

Exploit Title: WordPress Auctions plugin @AlligatorTeam Software Link: http://downloads.wordpress.org/plugin/wp-auctions.zip Version: 1.8.8 tested --------------- PoC --------------- URL:...

WordPress Plugin Tune Library 2.17 - SQL Injection

WordPress Plugin Tune Library 2.17 - SQL Injection Exploit Title: WordPress Tune Library plugin prefix . "tracks where artist != '' and artist like '" .$artistletter . "%' order by artist";...

WordPress Plugin Tune Library 2.17 - SQL Injection

Exploit Title: WordPress Tune Library plugin prefix . "tracks where artist != '' and artist like '" .$artistletter . "%' order by artist";...

WordPress Plugin A to Z Category Listing 1.3 - SQL Injection

Exploit Title: WordPress A to Z Category Listing plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- $initletter = $GET'R'; $sql = "select from ".$tableprefix."terms wpt,".$tableprefix."termtaxonomy wptt where wpt.name like...

WordPress Community Events 1.2.1 SQL Injection

Exploit Title: WordPress Community Events plugin getblogprefix . "ceevents where eventid = " . $eventid;...

WordPress Plugin Paid Downloads 2.01 - SQL Injection

Exploit Title: WordPress Paid Downloads plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- $downloadkey = $GET"downloadkey"; $sql = "SELECT FROM ".$wpdb-prefix."pddownloadlinks WHERE downloadkey = '".$downloadkey."'"; $linkdetails =...

WordPress Paid Downloads 2.01 SQL Injection

Exploit Title: WordPress Paid Downloads plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- $downloadkey = $GET"downloadkey"; $sql = "SELECT FROM ".$wpdb-prefix."pddownloadlinks WHERE downloadkey = '".$downloadkey."'"; $linkdetails =...

WordPress SCORM Cloud 1.0.6.6 SQL Injection

Exploit Title: WordPress SCORM Cloud plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 e.g.: curl --data "action=addAnonRegGetLaunchUrl&inviteid=-1' AND 1=IF21,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0-- " http://www.site.com/wp-content/plugins/scormcloud/ajax.php...

WordPress WP Forum Server 1.7 SQL Injection

Exploit Title: WordPress WP Forum Server plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20&editpostsubject=test&message=dummy&threadid=1 e.g. curl --data "editpostsubmit=1&editpostid=-1 AND...