27 lines
No EOL
856 B
Text
27 lines
No EOL
856 B
Text
# Exploit Title: Wordpress Plugin Search Meter 2.13.2 - CSV Injection
|
|
# Google Dork: N/A
|
|
# Date: 2020-03-10
|
|
# Exploit Author: Daniel Monzón (stark0de)
|
|
# Vendor Homepage: https://thunderguy.com/semicolon/
|
|
# Software Link: https://downloads.wordpress.org/plugin/search-meter.2.13.2.zip
|
|
# Version: 2.13.2
|
|
# Tested on: Windows 7 x86 SP1
|
|
# CVE : N/A
|
|
|
|
There is a CSV injection vulnerability in the Export function of the Search Meter plugin version
|
|
|
|
1) First we introduce the payload in the search bar in Wordpress
|
|
|
|
=cmd|' /C notepad'!'A1'
|
|
|
|
|
|
2) Then we go to http://127.0.0.1/wordpress/wp-admin/index.php?page=search-meter%2Fadmin.php and export the CSV file
|
|
|
|
|
|
3) After that we open the file in Excel, and import data from an external file, using comma as separator
|
|
|
|
|
|
4) Payload gets executed
|
|
|
|
|
|
Tested on Windows 7 Pro SP1 32-bit, Wordpress 5.3.2 and Excel 2016 |