WordPress hfile-upload Unauthorized File Insertation

####################################################################

# Exploit Title : WordPress hfile-upload Unauthorized File Insertation
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 06/03/2019
# Vendor Homepage : wordpress.org ~ themegrill.com/themes/accelerate
# Software Version : Free Version is 1.3.9  & Pro Version is 2.2.4.
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access Controls ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos

####################################################################

# Impact :
***********
WordPress hfile-upload is prone to an arbitrary file upload vulnerability.

An attacker may leverage this issue to upload arbitrary files to the affected computer;

this can result in arbitrary code execution within the context of the vulnerable application.

Weaknesses in this category are related to the management of permissions,

privileges, and other security features that are used to perform access control.

####################################################################

Copyright © 2019 St Augustine Pony Club.
Powered by WordPress. Theme: Accelerate by ThemeGrill.

# Arbitrary File Upload Exploit :
****************************
/wp-content/hfile-upload/form.php

# Directory File Path :
********************
/wp-content/hfile-upload/uploads/.....

NOTE: You can only upload .jpg, .jpeg, .png, .gif, .txt, or .pdf files.

####################################################################

# Vulnerable Source Code : [ form.php ]
************************************
<html>
 <head>
  <title>
   PHP File Upload Script - File Manipulation
  </title>
  <link href="./style.css" rel="stylesheet" type="text/css">
 <body>

<div class='frms' >
 <form action="" method="post" enctype="multipart/form-data">
<label>Upload File : </label><input type="file" name="file" id="file">
<input type="hidden" name="formatt" id="format" value='hscripts'>
<input type="submit" id="sub" value="Submit">

</form>

</div>
<div><strong>NOTE:</strong> You can only upload .jpg, .jpeg, .png, .gif, .txt, or .pdf files.<br><br>
Also, please make sure you label your coggins with your last name ( such as: Smith-coggins.jpg or Smith-coggins.pdf ) <br>
</div>
</body>
</html>

####################################################################

# Example Vulnerable Sites :
*************************
[+] staugustineponyclub.com/wp-content/hfile-upload/form.php

####################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

####################################################################