WordPress Persuasion Theme – Arbitrary File Download and File Deletion Exploit

日期: 2014/01/01 | 标签: | 游览：442

Exploit Title: Persuasion WordPress Theme – Arbitrary File Download and File Deletion Exploit
Date: 19 December 2013
Exploit Author: Interference Security
Vendor Homepage: http://mysitemyway.com/
Software Link: http://mysitemyway.com/theme/persuasion-wordpress-theme/
Version: Tested on 2.0 and 2.3

Details:
The vulnerable file is located at http://vulnerable-site.com/wp-content/themes/persuasion/lib/scripts/dl-skin.php
In exploit code, file name in first text box should be readable on the vulnerable server, then the vulnerable code allows it to be downloaded from the server. And the second textbox accepts a directory path. If it is writeable then vulnerable code will delete its contents.
An attacker can download readable files from the server and also can delete contents of writeable directories.

Vulnerable code:

Exploit Code:

Existing file’s name:
Directory to be removed:Use with caution it will delete the files and directories if it is writeable


—
Interference Security

评论关闭。