odlican.net CMS 1.5 – Arbitrary File Upload - 体验盒子

作者： anonymous

日期： 2010-02-06

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/11340/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

#odlican.net cms v.1.5 remote file upload vulnerability

#Author: Anonymous

#you can download following cms here

#http://cms.odlican.net/files/cmsv1-5.zip

#Info:odlican.net cms v.1.5 is simple opensource cms made by croatian web designers

and it has serious flaw.

#dork:Powered by odlican.net cms v.1.5

#what is vulnerable?

this is vulnerable part of code from upload.php and it will upload any file to /cms/files/ folder(including dangerous php scripts)

if ( isset($_POST['pokreni'])){

$target_path = "files/";

$target_path = $target_path . basename( $_FILES['uploadedfile']['name']);

if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {echo "Datoteka ". basename( $_FILES['uploadedfile']['name']). " je snimljena na server";} else{ echo "Došlo je do greške pokušajte ponovno!";}

}

#there should be code that will filter some extensions like .php etc.....

#fixajte si taj kod. dodajte da skripta provjerava ekstenzije i velicinu filea

#pozz