Wordpress Malicious File Execution Vulnerability

2008.05.21
Credit: tan_prathan
Risk: High
Local: Yes
Remote: Yes
CWE: CWE-20


CVSS Base Score: 9/10
Impact Subscore: 10/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

========================================================== Wordpress Malicious File Execution Vulnerability ========================================================== AUTHOR : CWH Underground DATE : 18 May 2008 SITE : www.citecclub.org ##################################################### APPLICATION : Wordpress Blog VERSION : <= 2.5.1 VENDOR : http://wordpress.org/ DOWNLOAD : http://wordpress.org/download ##################################################### DORK: N/A ---DESCRIPTION--- You must login into wordpress with Administrator Roles 1. Write Tabs - You can post title, contents and upload files. In Upload section, You can upload php script such as r57,c99,etc. into systems and upload's file will appear in http://[target]/wp-content/uploads/[year]/[month]/file.php 2. If you can't upload your php script: Found message "File type does not meet security guidelines. Try another" Dont Worry, Move to "plugins" Tabs and choose some plugins (Akismet, Hello Dolly) to EDIT it. Now you can add php script (r57/c99) into plugins edit section. Finished it and Back to Plugins Tabs -> Click Active plugins then Get your SHELL.... Let's Fun... ---NOTE/TIP--- In Plugins Edit section, Use comment /* ... */ to keep plugins code before add shells. ################################################################## Greetz: ZeQ3uL,BAD $ectors, Snapter, Conan, Win7dos, JabAv0C ##################################################################


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top