Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

5
  • 3
    Why should a normal registered user upload PHP files? As developer you have FTP. And WordPress 3.9 is outdated and probably insecure. Use the Chrome Developer Tools and take a look at the code of the img and the console. Commented Nov 14, 2015 at 11:25
  • Let's say that this is a pentest. So you say, that this is still possible to merge php with image, right? Commented Nov 14, 2015 at 13:48
  • 1
    What do you mean with merge? If you mean steganography, you might want to read information about such things like CryptoPHP. Generally you can append any content to images but this is generally malicious and insecure. Webshells are often uploaded through insecure plugins. But you can not simply bypass the core mediagallery function of WordPress. It normally reprocesses the images and removes appended codes and so on. Sure, you can misuse EXIF and other headers. If there is no vulnerability like you mean on wpvulndb.com there might not be one. Commented Nov 14, 2015 at 14:47
  • 1
    But I do not see any valid reason why you want to do this. Pentesters use tools which also test for file upload vulnerabilities. And you may have to read the sourcecode of the plugin to find possible vulnerabilities. Commented Nov 14, 2015 at 14:50
  • Yeah, just realized that there is a whole script that check's the uploaded code. I'm so stuck right now, cause I can get the admin account, but I can't do anything with it, cause permissions on theme editor/plugin editor are low and I can't edit plugin's/theme's files from the wp panel. The only 'permitted folder' is 'uploads', so I thought that I could somehow upload a PHP there and make it 'openable'. It's 3.9.2, clean, so it's totally insecure, but as we can see - permissions on files = win for the victim. Commented Nov 14, 2015 at 15:23