| 标题 | Projeqtor 12.0.2 Improper Input Validation |
|---|
| 描述 | A critical vulnerability in Projeqtor v12.0.2 allows authenticated users to upload malicious files through the /tool/saveAttachment.php endpoint, leading to arbitrary code execution. The application does not adequately validate or sanitize uploaded file types, permitting attackers to upload executable PHP files with extensions such as .phar or .php. Normally, Projeqtor appends .projeqtor.txt to .phar and .php filenames (e.g., miri.phar.projeqtor.txt), but this can be bypassed.
On Windows systems, attackers can exploit a filesystem quirk by specifying a filename like miri.php. (with a trailing dot). Windows silently strips the trailing dot when writing to the filesystem, resulting in a file named miri.php that can execute PHP code. This behavior is a deliberate strategy for bypassing extension restrictions, as the application may not flag the trailing dot as suspicious. Separately, using a semicolon in filenames (e.g., miri.phar;) is effective specifically for .phar files, potentially exploiting how the application or server parses extensions. In the provided proof-of-concept (PoC), a .phar file with the content demonstrates this by executing the dir command on a Windows server. |
|---|
| 来源 | ⚠️ https://github.com/deadmilkman/cve-reports/blob/main/01-projeqtor-rce/readme.md |
|---|
| 用户 | deadmilkman (UID 82903) |
|---|
| 提交 | 2025-03-26 14時48分 (2 年前) |
|---|
| 管理 | 2025-04-03 10時05分 (8 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 303128 [Projeqtor 直到 12.0.2 /tool/saveAttachment.php attachmentFiles 权限提升] |
|---|
| 积分 | 20 |
|---|