what you don't know can hurt you

WordPress SB Uploader 3.9 Shell Upload

WordPress SB Uploader 3.9 Shell Upload
Posted Dec 30, 2012
Authored by Evil aXe

WordPress SB Uploader version 3.9 suffers from an arbitrary file upload vulnerability.

tags | exploit, arbitrary, file upload
MD5 | d5e260363b0f191032ddbda1d9f6839e

WordPress SB Uploader 3.9 Shell Upload

Change Mirror Download
# Exploit Title: WordPress SB Uploader 3.9 Arbitrary File Upload Vulnerability
# Exploit Author: Evil aXe
# http://www.facebook.com/iChocolate.lips
# Date: 30/12/12
# Greetz: R3x0Man, Shadman tanjim, Shahee Mirza, JingoBD, ManInDark And All Crew and Members of Bangladesh Cyber Army.
# Software Link: http://wordpress.org/extend/plugins/sb-uploader/
# Version: 3.9
# Category: webapps
# Tested on: [Windows 7]
# Google Dork : "inurl:plugins/sb-uploader"

=====================
Vulnerability : Arbitrary File Upload Vulnerability
=====================
Exploit Details :
=====================

1. Register
2. Login [Confirm your email then login]
3. Add a New post
4. Write title,body something what you want :)
5. Look at the Right slidbar " SB Uploader" panel and upload your file :)
6. Publish the post
7. You file is uploaded here : /wp/wp-content/uploads/2012/02/yourfile[.]ext

=====================
p0c: localhost/wp/wp-content/uploads/2012/12/cOol.htm
=====================
♥ BCA ♥

Comments (1)

RSS Feed Subscribe to this comment feed
digip

How is being a logged in user, an attack on a system? I fail to see how this is a vulnerability.

I think the larger attack vector here, is the fact the plug-in uses TimThumb.php and can be spoofed with DNS rebinding attacks to upload php shells, although this version isn't vulnerable since it appends all files with .timthumb.txt so PHP files can't execute.

Unless you have more info to share on how this can be remotely exploited to upload a file while NOT logged into the system, I call shenanigans, and this is NOT a vulnerability in the plug-in. Being a logged in user, you would have certain privileges to begin with.

Comment by digip
2012-12-31 18:44:24 UTC | Permalink | Reply
Login or Register to post a comment

File Archive:

April 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    21 Files
  • 2
    Apr 2nd
    35 Files
  • 3
    Apr 3rd
    21 Files
  • 4
    Apr 4th
    16 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    1 Files
  • 7
    Apr 7th
    2 Files
  • 8
    Apr 8th
    23 Files
  • 9
    Apr 9th
    19 Files
  • 10
    Apr 10th
    15 Files
  • 11
    Apr 11th
    14 Files
  • 12
    Apr 12th
    11 Files
  • 13
    Apr 13th
    2 Files
  • 14
    Apr 14th
    5 Files
  • 15
    Apr 15th
    14 Files
  • 16
    Apr 16th
    19 Files
  • 17
    Apr 17th
    19 Files
  • 18
    Apr 18th
    8 Files
  • 19
    Apr 19th
    4 Files
  • 20
    Apr 20th
    5 Files
  • 21
    Apr 21st
    1 Files
  • 22
    Apr 22nd
    10 Files
  • 23
    Apr 23rd
    22 Files
  • 24
    Apr 24th
    11 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close