The WordPress MM Forms Community plugin suffers from a shell upload vulnerability.
93726eada7c325e25baf4be778cd1e25920dc33acfd13ea1ba17520ad40787e2
.___ .___ .__ _________ .___
| | ____ __| _/ ____ ____ ____ ______|__|_____ ____ \_ ___ \ ____ __| _/ ____ _______
| | / \ / __ | / _ \ / \ _/ __ \ / ___/| |\__ \ / \ / \ \/ / _ \ / __ | _/ __ \ \_ __ \
| || | \/ /_/ | ( <_> )| | \\ ___/ \___ \ | | / __ \_| | \\ \____( <_> )/ /_/ | \ ___/ | | \/
|___||___| /\____ | \____/ |___| / \___ >/____ >|__|(____ /|___| / \______ / \____/ \____ | \___ > |__|
\/ \/ \/ \/ \/ \/ \/ \/ \/ \/
[~]===========================================================================[~]
[~]Title : WordPress plugin MM Forms Community File Upload
[~]Software : MM Forms Community Plugin
[~]Vendor : http://plugins.motionmill.com/
[~]Download : NN
[~]Author : failed_404
[~]Contact : failed404@gmail.com
[~]Google Dork : inurl:"wp-content/plugins/st_newsletter"
[~]===========================================================================[~]
################################################################################################################################
===[ Exploit ]===
[»] http://[target].com/wp-content/plugins/mm-forms-community/includes/ajaxfileupload.php
[»] http://[target].com/[path]/wp-content/plugins/mm-forms-community/includes/ajaxfileupload.php
===[ Installation ]===
1. Upload whole `mm-forms-community` folder to the `/wp-content/plugins/` directory
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Make following directories writable (chmod 777) /exports/ and /captcha/tmp /upload
===[ Live Demo ]===
[~]http://www.dad-asia.com/wp-content/plugins/mm-forms-community/includes/ajaxfileupload.php
[~]http://www.pgdnhost.com/alfa/wp-content/plugins/mm-forms-community/includes/ajaxfileupload.php
################################################################################################################################
Greats T0 :
./ INDONESIANCODER - EXPLOIT-ID - MAGELANGCYBER TEAM - MALANGCYBER CREW - DEVILZCODE - EXPLORE CREW
./ kaMtiEz eL Farhatz Xrobot Tukulesto R3m1ck n4ck0 - vYc0d - Caddy-Dz K4pT3N - Chaer.Newbie - Yur4kh4 - Kedanz-Dz
./ ade yonatan Mboys k4l0ng666 kido dr.cruzz tabun GonzHack RyanAby - Alecs - Jundab - Ibl13Z - Hmei7 - nakula
./ And All My Friend
Note :
./ Cepat sembuh sayangku , I Love You Fitri Ardiyadila
./ Gathering Indonesian Coder in Magelang Ketua ne yo mas kaMtiEz
./ Susah nyari sahabat yang bisa jadi tempat curhat kala senang dan sedih