| 제목 | itsourcecode Online Medicine Delivery System v1.0 Remote Code Execution |
|---|
| 설명 | 1. Description
The rider backend order management controller /rider/orders/controller.php of Online Medicine Delivery System contains a file upload vulnerability in the doInsert() function. The function uses getimagesize() to verify whether the uploaded file is an image, but does not perform whitelist validation on file extensions or randomly rename uploaded files. An attacker can craft a GIF89a image shell to bypass the check while retaining the .php extension so the server parses and executes it as a PHP script.
2. Impact
(1) Remote Code Execution (RCE): An attacker can upload a web shell to obtain server command execution privileges, fully controlling the server
(2) No Valid Authentication Required: Since the authentication function uses JS redirect without terminating PHP execution, any session can pass (even without a session)
(3) Sensitive Data Disclosure: Through RCE, arbitrary server files can be read (configuration files, database credentials, user data, etc.)
(4) Internal Network Pivoting: After obtaining a server shell, it can be used as a pivot point for further penetration into the internal network
(5) Persistent Backdoor: The uploaded web shell persists on the server and can be accessed repeatedly |
|---|
| 원천 | ⚠️ https://github.com/boyslikesports/202607_vul_dir/blob/main/H-12-FileUpload-RCE-RiderOrders_en.md |
|---|
| 사용자 | xwniscoming2002 (UID 99874) |
|---|
| 제출 | 2026. 07. 16. PM 04:06 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 03. PM 03:15 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 398416 [itsourcecode Online Medicine Delivery System 1.0 Order Management Controller controller.php?action=add doInsert image 권한 상승] |
|---|
| 포인트들 | 20 |
|---|