Rapid7 Vulnerability & Exploit Database

Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload

Back to Search

Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload

Disclosed
07/01/2014
Created
05/30/2018

Description

The Wordpress plugin "MailPoet Newsletters" (wysija-newsletters) before 2.6.8 is vulnerable to an unauthenticated file upload. The exploit uses the Upload Theme functionality to upload a zip file containing the payload. The plugin uses the admin_init hook, which is also executed for unauthenticated users when accessing a specific URL. The first fix for this vulnerability appeared in version 2.6.7, but the fix can be bypassed. In PHP's default configuration, a POST variable overwrites a GET variable in the $_REQUEST array. The plugin uses $_REQUEST to check for access rights. By setting the POST parameter to something not beginning with 'wysija_', the check is bypassed. Wordpress uses the $_GET array to determine the page, so it is not affected by this. The developers applied the fixes to all previous versions too.

Author(s)

  • Marc-Alexandre Montpas
  • Christian Mehlmauer <FireFart@gmail.com>

Platform

PHP

Architectures

php

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/unix/webapp/wp_wysija_newsletters_upload
msf exploit(wp_wysija_newsletters_upload) > show targets
    ...targets...
msf exploit(wp_wysija_newsletters_upload) > set TARGET < target-id >
msf exploit(wp_wysija_newsletters_upload) > show options
    ...show and set options...
msf exploit(wp_wysija_newsletters_upload) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;