BugTraq
Wordpress Malicious File Execution Vulnerability May 19 2008 05:13AM
tan_prathan hotmail com
==========================================================

Wordpress Malicious File Execution Vulnerability

==========================================================

AUTHOR : CWH Underground

DATE : 18 May 2008

SITE : www.citecclub.org

#####################################################

APPLICATION : Wordpress Blog

VERSION : <= 2.5.1

VENDOR : http://wordpress.org/

DOWNLOAD : http://wordpress.org/download

#####################################################

DORK: N/A

---DESCRIPTION---

You must login into wordpress with Administrator Roles

1. Write Tabs - You can post title, contents and upload files. In Upload section, You can upload php script such as r57,c99,etc. into systems

and upload's file will appear in http://[target]/wp-content/uploads/[year]/[month]/file.php

2. If you can't upload your php script: Found message "File type does not meet security guidelines. Try another"

Dont Worry, Move to "plugins" Tabs and choose some plugins (Akismet, Hello Dolly) to EDIT it. Now you can add php script (r57/c99) into plugins edit section.

Finished it and Back to Plugins Tabs -> Click Active plugins then Get your SHELL....

Let's Fun...

---NOTE/TIP---

In Plugins Edit section, Use comment /* ... */ to keep plugins code before add shells.

##################################################################

Greetz: ZeQ3uL,BAD $ectors, Snapter, Conan, Win7dos, JabAv0C

##################################################################

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus