| Título | Project Worlds Complaint Management System unknown Remote Code Execution (RCE) via Unrestricted File Upload |
|---|
| Descrição | ### **Vendor and Product Information:**
- **Vendor:** Project Worlds
- **Product:** **Complaint Management System**
- **Product URL:** [Complaint Management System](https://www.sourcecodester.com/php/13333/file-management-system-very-complete-using-phpmysqli.html)
### **Vulnerability Details:**
- **Vulnerability Location:** File Upload Functionality
- **Vulnerability Type:** Remote Code Execution (RCE)
- **Affected Component:** [users/register-complaint.php]
- **Severity:** Critical
### **Description:**
### Vulnerable Family:
The vulnerability exists in the file upload functionality of the [Product Name]. The application fails to properly validate file uploads, allowing attackers to upload and execute arbitrary PHP files.
### Current Situation:
Attackers can exploit this vulnerability by logging in to a user account (e.g., [email protected]), navigating to the "Lodge Complaint" section, and uploading a malicious PHP file. By intercepting the upload request with tools like Burp Suite, attackers can modify the content of the PHP file to contain code that executes system commands. Upon successful upload, attackers can trigger the execution of the uploaded PHP file by viewing the details of the complaint and choosing the uploaded file, leading to remote code execution on the server. |
|---|
| Fonte | ⚠️ https://toradah.notion.site/Remote-Code-Execution-RCE-via-Unrestricted-File-Upload-6ed7ae9c833c4d8baaae7d64ae0c4a47?pvs=4 |
|---|
| Utilizador | torada (UID 61170) |
|---|
| Submissão | 24/02/2024 10h06 (há 2 anos) |
|---|
| Moderação | 25/02/2024 19h26 (1 day later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 254723 [SourceCodester Complaint Management System 1.0 Lodge Complaint Section register-complaint.php Elevação de Privilégios] |
|---|
| Pontos | 17 |
|---|