Tested on: WordPress 4.5.2
WP- Levoslideshow is a wordpress Plugin is a plugin where users can display slideshow multiple instance in their post which different categories & Images.
PoC ( Proof Of Concept ):
- Login as an unprivileged user, who was no privilege of even uploading a plugin
- Go to http://site.com/wp-admin/admin.php?page=levoslideshow_manage
- If any Gallery exists than don’t create and go to “Category Management”, Click on “Add New”, Upload any .png / ,jpg image from your PC and intercept the request
- After Intercepting the request while upload, Send request to Repeater . And change filename = image.png.php and in $POST image data add your PHP Backdoor between image chunk . It should look like this
- Forward the request and go to site.com/wp-content/uploads/levoslideshow/[ALBUM_NUMBER]_uploadfolder/big/[YourShell] to access your shell.
That’s it All you Have done perfect 🙂 .