\#'#/
                            (-.-)
   --------------------oOO---(_)---OOo----------------------
   |     IDIC Blogs Arbitrary File Upload Vulnerability    |
   ---------------------------------------------------------
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Site: http://0xuht.org
[!] Download: http://sourceforge.net/projects/idicblogs/files/
[!] Version: -
[!] Date: 12.11.2012
[!] Remote: yes
[!] Tested: Ubuntu
[!] Reference: http://0xuht.org/Exploit/idic-blog.txt

[!] Details:
    By issuing a POST request with a webshell
    embedded in a JPEG or PJPEG image it is possible to upload
 
 
[!] Vulnerability Code [picture_upload.php] :
 
<? 
} elseif (isset($_POST['subpage']) && $_POST['subpage'] == 'upload') {
  
$idir="./members_orgimage/";  
$string = md5(rand(0,9999));
$harland = substr($string, 17, 5);

  $url = $_FILES['imagefile']['name'];  /* Set $url To Equal The Filename For Later Use */
  if ($_FILES['imagefile']['type'] == "image/jpg" || $_FILES['imagefile']['type'] == "image/jpeg" || $_FILES['imagefile']['type'] == "image/pjpeg") { 
 
//   $file_ext = strrchr($_FILES['imagefile']['name'], '.'); 
//    $file_ext = strrchr($_FILES['imagefile']['name'], "."); 
$file_ext = strtolower(substr(strrchr($_FILES['imagefile']['name'], "."), 1));
      
/* Get The File Extention In The Format Of , For Instance, .jpg, .gif or .php */
    $copy = copy($_FILES['imagefile']['tmp_name'], "$idir" . $_FILES['imagefile']['name']);  
 /* Move Image From Temporary Location To Permanent Location */
    if ($copy) {
$newimage = "$harland-$url";
         
cropImage("50", "50", "./members_orgimage/$url", "jpg", "./members_thumbs/$newimage");

      $query = mysql_query("UPDATE blogssmembers SET picname='$newimage' WHERE username='$ses_bloguser'") or die (mysql_error());
      $result = mysql_query($query);

$es = 'Image uploaded successfully.<br />'; 
    }else{
$es = 'ERROR: Unable to upload image<br />';          
    }
} else {
$es = 'ERROR: Wrong filetype (has to be a .jpg or .jpeg.)<br />';    
  }   
}
if($es){
?>
 
 
[!] PoC (Piye om Carane):
 
    [IDIC_Blogs]/picture_upload.php

[!] Shell:

    [IDIC_Blogs]//members_orgimage/shell.php.pjpeg

[!] Demo:

    http://0xuht.org/demo/idic-blog1.png
    http://0xuht.org/demo/idic-blog2.png

[!] Thanks: packetstormsecurity

// Gorontalo [2012-11-12]