Lucene search
Larry W. CashdollarWPVDB-ID:8B9436D4-3950-40FC-8220-4AE8F0E77F9AHistoryJul 05, 2015 - 12:00 a.m.
WP e-Commerce Shop Styling <= 2.5 - Local File Inclusion
2015-07-0500:00:00
Larry W. Cashdollar
wpscan.com
11
EPSS
0.025
Percentile
90.3%
The code in ./wp-ecommerce-shop-styling/includes/download.php does not sanitise user input to prevent sensitive system files from being downloaded. You’ll have to rename the download file via mv – -…-…-…-…-…-…-…-…-etc-passwd passwd as the filename is set to the download filename with path.
PoC
References
github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wp_ecommerce_shop_styling_file_read.rb
packetstormsecurity.com/files/132594/
plugins.trac.wordpress.org/changeset/1193456/wp-ecommerce-shop-styling
vapid.dhs.org/advisory.php?v=136
wordpress.org/support/topic/wp-e-commerce-shop-styling?replies=2
Related
cvelist
cvelist
CVE-2015-5468
2017-05-23 03:56:00
wpexploit
wpexploit
WP e-Commerce Shop Styling <= 2.5 - Local File Inclusion
2015-07-05 00:00:00
nvd
nvd
CVE-2015-5468
2017-05-23 04:29:00
cve
cve
CVE-2015-5468
2017-05-23 04:29:00
prion
prion
Directory traversal
2017-05-23 04:29:00
exploitdb
exploitdb
WordPress Plugin WP E-Commerce Shop Styling 2.5 - Arbitrary File Download
2015-07-08 00:00:00
threatpost
threatpost
Attackers Target 1M+ WordPress Sites To Harvest Database Credentials
2020-06-03 20:37:44
openvas
openvas