XML Sitemap Generator 3.2.8 Code Injection

`1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0  
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ >> Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 1  
0 [+] Site : 1337day.com 0  
1 [+] Support e-mail : submit[at]1337day.com 1  
0 0  
1 ######################################### 1  
0 I'm AkaStep member from Inj3ct0r Team 1  
1 ######################################### 0  
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  
================================================================================  
Vendor: http://www.arnebrachhold.de/redir/sitemap-home/  
Software: XML Sitemap Generator for Wordpress aka (Google XML Sitemaps) plugin.  
Vuln: PHP CODE injection.  
================================================================================  
Tested On: Debian squeeze 6.0.6  
Server version: Apache/2.2.16 (Debian)  
PHP 5.3.3-7+squeeze14 with Suhosin-Patch (cli) (built: Aug 6 2012 20:08:59)  
Copyright (c) 1997-2009 The PHP Group  
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies  
with Suhosin v0.9.32.1, Copyright (c) 2007-2010, by SektionEins GmbH  
================================================================================  
About Software:  
This plugin will generate a special XML sitemap which will help search engines like Google, Bing,  
Yahoo and Ask.com to better index your blog.  
With such a sitemap, it's much easier for the crawlers to see the complete structure of your site   
and retrieve it more efficiently.  
The plugin supports all kinds of WordPress generated pages as well as custom URLs.  
Additionally it notifies all major search engines every time you create a post about the new content.  
================================================================================  
About vulns:  
  
XML Sitemap Generator for Wordpress v<=3.2.8 (Google XML Sitemaps) plugin PHP CODE injection.  
  
1'st issuse: The "xml" file name and extension can be changed to any name+extension.  
  
A) Due this issuse it is possible to create any file with any extension on filesystem.  
B) Using this condition this is possible to overwrite arbitrary files on system(even if the target file(s) chmod'ed to 400!)  
  
2'nd issuse:  
  
By manipulating $_POST:  
  
sm_cf_home=PHP CODE PAYLOAD GOES HERE  
sm_cf_posts=PHP CODE PAYLOAD GOES HERE  
  
parameters and by injecting PHP CODE into this parameters it is possible to gain shell access there(shell upload).  
  
Proof of concept video can be found here about how to exploit this vulnerabilities:  
  
http://youtu.be/30OZanIoICE  
  
  
To exploit this vulnerabilities you need admin privileges on target site.  
  
To get successfull and easy shell access short_open_tag php.ini directive (php.ini) on  
server side must be set =off (otherwise you'll get syntax error when creating shell).  
But this is not panacea.Theris also another ways to solve this.Found it yourself.  
  
In itself this vulnerabilities can be used to escalate privileges on target site and fully compromise site and server.  
  
==GUNUN RANDOM SITATI:======GOTDU OGUL ISTEREM! LOOOOOOOL=======================  
  
  
  
  
  
================================================  
KUDOSSSSSSS:  
================================================  
packetstormsecurity.org  
packetstormsecurity.com  
packetstormsecurity.net  
securityfocus.com  
cxsecurity.com  
security.nnov.ru  
securtiyvulns.com  
securitylab.ru  
secunia.com  
securityhome.eu  
exploitsdownload.com  
osvdb.com  
websecurity.com.ua  
1337day.com  
  
to all Aa Team + to all Azerbaijan Black HatZ  
+ *Especially to my bro CAMOUFL4G3 *  
To All Turkish Hackers  
  
Also special thanks to: ottoman38 & HERO_AZE  
================================================  
  
/AkaStep  
  
  
  
  
  
  
`