| tiêu đề | Monitorr Monitorr 1.0 upload file lead to Remote code execution in monitorr |
|---|
| Mô tả | Description
The code is vulnerable to uploading malicious files like PHP files and leads to Remote Code Execution also it can upload the PHP file without needing to be login
Steps to the procedure
1- intercept the request for uploading images
2- edit the extension of the file to `file.php`
3- inject the PHP code inside the body of the image
4- access the path of the shell you upload and execute a command on the server
at all this procedure can be done without no need for a session of the user
|
|---|
| Nguồn | ⚠️ https://drive.google.com/file/d/1C6_4A-96BtR9VTNSadUY09ErroqLEVJ4/view?usp=sharing |
|---|
| Người dùng | torada (UID 61170) |
|---|
| Đệ trình | 09/01/2024 18:11 (cách đây 3 những năm) |
|---|
| Kiểm duyệt | 19/01/2024 07:51 (10 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 251539 [Monitorr 1.7.6m Services Configuration /assets/php/upload.php fileToUpload nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|