odlican.net CMS 1.5 – Arbitrary File Upload

• Exploit Database
• 56 阅读

• 作者： anonymous
  日期： 2010-02-06
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11340/

• #odlican.net cms v.1.5 remote file upload vulnerability
  
  
  #Author: Anonymous
  
  
  #you can download following cms here
  #http://cms.odlican.net/files/cmsv1-5.zip
  
  
  
  #Info:odlican.net cms v.1.5 is simple opensource cms made by croatian web designers
  and it has serious flaw.
  
  
  #dork:Powered by odlican.net cms v.1.5
  
  
  
  #what is vulnerable?
  
  this is vulnerable part of code from upload.php and it will upload any file to /cms/files/ folder(including dangerous php scripts)
  
  if ( isset($_POST['pokreni'])){
  	 $target_path = "files/";
  	 $target_path = $target_path . basename( $_FILES['uploadedfile']['name']);
  	 if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {echo "Datoteka ". basename( $_FILES['uploadedfile']['name']). " je snimljena na server";} else{ echo "Došlo je do greške pokušajte ponovno!";}
  	 }
  
  
  
  
  #there should be code that will filter some extensions like .php etc.....
  
  #fixajte si taj kod. dodajte da skripta provjerava ekstenzije i velicinu filea
  
  #pozz