# Exploit Title: Wordpress WP Easy Slideshow Plugin Multiple Vulnerabilities
# Google Dork: inurl:/wp-content/uploads/wp-easy-slideshow/
# Date: 2 April 2015
# Exploit Author: Divya
# Vendor Homepage: https://wordpress.org/plugins/wp-easy-slideshow/
# Software Link: https://downloads.wordpress.org/plugin/wp-easy-slideshow.zip
# Version: 1.0.3
# Tested on: Windows, Linux
# CVE : None
Delete operation using CSRF:
Example: http://192.168.1.2/wp-admin/admin.php?page=wss-images&del_id=1
CSRF Delete Operation
Arbitrary File Upload using CSRF:
WP CSRF File Upload
Arbitrary File Upload (Authenticated):
URL: http://192.168.1.2/wp-admin/admin.php?page=wss-add-image
The upload script allows uploading arbitrary files. The files are renamed to numbers like 1,2,3,... The uploaded files cannot be executed on server.
Upload Location: http://192.168.1.2/wp-content/uploads/wp-easy-slideshow/