####################################################################
# Exploit Title : WordPress HT-Poi Plugins 2.9 Unauthorized File Insertation
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 06/03/2019
# Vendor Homepage : wordpress.org
# Software Download Link : wordpress.org/plugins/ht-poi/
# Software Affected Version : 2.8 - 2.9
# Software Developer : Ipstenu (Mika Epstein)
# Solution : Upgrade/Update to 3.0
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access Controls ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
####################################################################
# Information about Software :
***************************
“HT Poi” is open source software for WordPress.
####################################################################
# Impact :
***********
WordPress HT-Poi Plugins 2.9 and previous versions is prone to an arbitrary file upload vulnerability.
An attacker may leverage this issue to upload arbitrary files to the affected computer;
this can result in arbitrary code execution within the context of the vulnerable application.
Weaknesses in this category are related to the management of permissions,
privileges, and other security features that are used to perform access control.
####################################################################
# Vulnerable Source Code :
************************
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>File Upload</title>
<link rel="stylesheet" type="text/css" href="CSS/poi.css" />
<body>
<div id="uploads_cont">
<h1 style="font-size:20px;">Images: </h1>
<table>
<tr>
<td colspan="4">
<input type="file" style="background-color:#FFF; border:1px solid #CCC;" /> <input type="text" name="title" style="background-color:#FFF; border:1px solid #CCC;" /> <input type="submit" name="subImage" value="Upload Image" style="background-color:#FFF; border:1px solid #CCC;" />
</td>
</tr>
<tr>
<th class="title" style="width:258px; text-align:left;"> Title </th>
<th class="title" style="width:258px; text-align:left;"> Url </th>
<th class="title" style="text-align:left;"> Image </th>
<th class="title"> </th>
</tr>
<tr class="image_seperator">
<td colspan="3"> </td>
</tr>
<tr>
</tr>
</table>
</div>
</body>
</html>
####################################################################
# Arbitrary File Upload Exploit :
*****************************
/wp-content/plugins/HT-Poi/file_upload.php
####################################################################
# Example Vulnerable Site :
*************************
[+] hotelpanorama-aegina.gr/wp-content/plugins/HT-Poi/file_upload.php
####################################################################
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
####################################################################
