| Название | Project Worlds Complaint Management System unknown Remote Code Execution (RCE) via Unrestricted File Upload |
|---|
| Описание | ### **Vendor and Product Information:**
- **Vendor:** Project Worlds
- **Product:** **Complaint Management System**
- **Product URL:** [Complaint Management System](https://www.sourcecodester.com/php/13333/file-management-system-very-complete-using-phpmysqli.html)
### **Vulnerability Details:**
- **Vulnerability Location:** File Upload Functionality
- **Vulnerability Type:** Remote Code Execution (RCE)
- **Affected Component:** [users/register-complaint.php]
- **Severity:** Critical
### **Description:**
### Vulnerable Family:
The vulnerability exists in the file upload functionality of the [Product Name]. The application fails to properly validate file uploads, allowing attackers to upload and execute arbitrary PHP files.
### Current Situation:
Attackers can exploit this vulnerability by logging in to a user account (e.g., [email protected]), navigating to the "Lodge Complaint" section, and uploading a malicious PHP file. By intercepting the upload request with tools like Burp Suite, attackers can modify the content of the PHP file to contain code that executes system commands. Upon successful upload, attackers can trigger the execution of the uploaded PHP file by viewing the details of the complaint and choosing the uploaded file, leading to remote code execution on the server. |
|---|
| Источник | ⚠️ https://toradah.notion.site/Remote-Code-Execution-RCE-via-Unrestricted-File-Upload-6ed7ae9c833c4d8baaae7d64ae0c4a47?pvs=4 |
|---|
| Пользователь | torada (UID 61170) |
|---|
| Представление | 24.02.2024 10:06 (2 лет назад) |
|---|
| Модерация | 25.02.2024 19:26 (1 day later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 254723 [SourceCodester Complaint Management System 1.0 Lodge Complaint Section register-complaint.php эскалация привилегий] |
|---|
| Баллы | 17 |
|---|