Alumni Management System 1.0 Shell Upload

2020.12.15

Credit: Valerio Alessandroni

Risk: High

Local: No

Remote: Yes

CVE: CVE-2020-28072

CWE: CWE-264

CVSS Base Score: 6.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8/10

Exploit range: Remote

Attack complexity: Low

Authentication: Single time

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

# Exploit Title: Remote Code Execution on Alumni Management System 
# Date: 23/10/2020
# Exploit Author: Valerio Alessandroni
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14524/alumni-management-system-using-phpmysql-s ource-code.html
# Version: 1.0
# Tested on: ubuntu 18.04
# CVE : CVE-2020-28072
# Description:



# Reproduction:

- Log in the administration panel, through http://127.0.0.1/admin/index.php?page=gallery, 
- upload a malicious php file using the form in the page.
- Executes command via the uploaded file http://127.0.0.1/admin/assets/uploads/gallery/[ID]_img.php
- The [ID] is a variable progressive number, it can be found in the html source code in the same page

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Alumni Management System 1.0 Shell Upload

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.