Wordpress Malicious File Execution Vulnerability
==========================================================
Wordpress Malicious File Execution Vulnerability
==========================================================
AUTHOR : CWH Underground
DATE : 18 May 2008
SITE : www.citecclub.org
#####################################################
APPLICATION : Wordpress Blog
VERSION : <= 2.5.1
VENDOR : http://wordpress.org/
DOWNLOAD : http://wordpress.org/download
#####################################################
DORK: N/A
---DESCRIPTION---
You must login into wordpress with Administrator Roles
1. Write Tabs - You can post title, contents and upload files. In
Upload section, You can upload php script such as r57,c99,etc. into systems
and upload's file will appear in
http://[target]/wp-content/uploads/[year]/[month]/file.php
2. If you can't upload your php script: Found message "File type does
not meet security guidelines. Try another"
Dont Worry, Move to "plugins" Tabs and choose some plugins (Akismet, Hello
Dolly) to EDIT it. Now you can add php script (r57/c99) into plugins edit
section.
Finished it and Back to Plugins Tabs -> Click Active plugins then Get your
SHELL....
Let's Fun...
---NOTE/TIP---
In Plugins Edit section, Use comment /* ... */ to keep plugins code
before add shells.
##################################################################
Greetz: ZeQ3uL,BAD $ectors, Snapter, Conan, Win7dos, JabAv0C
##################################################################