| タイトル | itsourcecode Online Medicine Delivery System v1.0 Remote Code Execution |
|---|
| 説明 | 1. Description
The rider backend order management controller /rider/orders/controller.php of Online Medicine Delivery System contains a file upload vulnerability in the doInsert() function. The function uses getimagesize() to verify whether the uploaded file is an image, but does not perform whitelist validation on file extensions or randomly rename uploaded files. An attacker can craft a GIF89a image shell to bypass the check while retaining the .php extension so the server parses and executes it as a PHP script.
2. Impact
(1) Remote Code Execution (RCE): An attacker can upload a web shell to obtain server command execution privileges, fully controlling the server
(2) No Valid Authentication Required: Since the authentication function uses JS redirect without terminating PHP execution, any session can pass (even without a session)
(3) Sensitive Data Disclosure: Through RCE, arbitrary server files can be read (configuration files, database credentials, user data, etc.)
(4) Internal Network Pivoting: After obtaining a server shell, it can be used as a pivot point for further penetration into the internal network
(5) Persistent Backdoor: The uploaded web shell persists on the server and can be accessed repeatedly |
|---|
| ソース | ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/H-12-FileUpload-RCE-RiderOrders_en.md |
|---|
| ユーザー | xwniscoming2002 (UID 99874) |
|---|
| 送信 | 2026年07月16日 16:06 (2 月 ago) |
|---|
| モデレーション | 2026年09月03日 15:15 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 398416 [itsourcecode Online Medicine Delivery System 1.0 Order Management Controller controller.php?action=add doInsert image 特権昇格] |
|---|
| ポイント | 20 |
|---|