WordPress WP Insert 2.4.2 Arbitrary File Upload Vulnerability

# Exploit Title: Wordpress Plugin Wp Insert - 'Fckeditor' Arbitrary File
Upload
# Exploit Author: Mostafa Gharzi
# Website: https://www.certcc.ir
# Google Dork: /wp-content/plugins/wp-insert
# Vendor: Namith Jawahar
# Software Link: https://wordpress.org/plugins/wp-insert/
# Affected Version: 2.4.2 and before
# Active installations: 30,000+
# Patched Version: unpatched
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64 & Kali Linux

# 1. Plugin Description:
# WP-INSERT by SmartLogix : The Ultimate Adsense / Ad-Management Plugin for
WordPress (Optimized for Adsense)
# Wp-Insert is the most powerful yet easiest to use wordpress ad management
/ ad insertion plugin which does
# a lot more than ad management / insertion.

# 2. Technical Description:
# WordPress Plugin Wp-Insert 2.4.2 and Before allows the attacker to upload
or transfer files of dangerous types
# that can be automatically processed within the product's environment.This
vulnerability is caused by FCKeditor
# in this plugin. Uploaded files represent a significant risk to
applications. The first step in many attacks is
# to get some code to the system to be attacked. Then the attack only needs
to find a way to get the code executed.
# Using a file upload helps the attacker accomplish the first step.The
consequences of unrestricted file upload can vary,
# including complete system takeover, an overloaded file system or
database, forwarding attacks to back-end systems,
# client-side attacks, or simple defacement. It depends on what the
application does with the uploaded file and especially
# where it is stored.

# 3. Proof Of Concept (PoC):
#
http://localhost/wp-content/plugins/wp-insert/fckeditor/editor/filemanager/connectors/uploadtest.html
#
http://localhost/wp-content/plugins/wp-insert/fckeditor/editor/filemanager/connectors/test.html
#
http://localhost/wp-content/plugins/wp-insert/fckeditor/editor/filemanager/browser/default/browser.html
# 4. Demo:
#
https://www.rtiprofi.com/wp-content/plugins/wp-insert/fckeditor/editor/filemanager/connectors/uploadtest.html

#  0day.today [2018-10-02]  #