Alumni Management System 1.0 Shell Upload

2020.12.15

Credit: Valerio Alessandroni

Risk: High

Local: No

Remote: Yes

CVE: CVE-2020-28072

CWE: CWE-264

Ogólna skala CVSS: 6.5/10

Znaczenie: 6.4/10

Łatwość wykorzystania: 8/10

Wymagany dostęp: Zdalny

Złożoność ataku: Niska

Autoryzacja: Jednorazowa

Wpływ na poufność: Częściowy

Wpływ na integralność: Częściowy

Wpływ na dostępność: Częściowy

# Exploit Title: Remote Code Execution on Alumni Management System 
# Date: 23/10/2020
# Exploit Author: Valerio Alessandroni
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14524/alumni-management-system-using-phpmysql-s ource-code.html
# Version: 1.0
# Tested on: ubuntu 18.04
# CVE : CVE-2020-28072
# Description:



# Reproduction:

- Log in the administration panel, through http://127.0.0.1/admin/index.php?page=gallery, 
- upload a malicious php file using the form in the page.
- Executes command via the uploaded file http://127.0.0.1/admin/assets/uploads/gallery/[ID]_img.php
- The [ID] is a variable progressive number, it can be found in the html source code in the same page

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Alumni Management System 1.0 Shell Upload

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.