odlican.net CMS 1.5 - Arbitrary File Upload

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1059177 漏洞类型
发布时间 2010-02-06 更新时间 2010-02-06
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/11340
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#odlican.net cms v.1.5 remote file upload vulnerability


#Author: Anonymous


#you can download following cms here
#http://cms.odlican.net/files/cmsv1-5.zip



#Info:odlican.net cms v.1.5 is simple opensource cms made by croatian web designers
and it has serious flaw.


#dork:Powered by odlican.net cms v.1.5



#what is vulnerable?

this is vulnerable part of code from upload.php and it will upload any file to /cms/files/ folder(including dangerous php scripts)

if ( isset($_POST['pokreni'])){
	 $target_path = "files/";
	 $target_path = $target_path . basename( $_FILES['uploadedfile']['name']);
	 if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {echo "Datoteka ". basename( $_FILES['uploadedfile']['name']). " je snimljena na server";} else{ echo "Došlo je do greške pokušajte ponovno!";}
	 }




#there should be code that will filter some extensions like .php etc.....

#fixajte si taj kod. dodajte da skripta provjerava ekstenzije i velicinu filea

#pozz