Become a patron and gain access to the dashboard, Schedule scans, API and Search

Search for hundreds of thousands of exploits

"qdPM 9.1 - Arbitrary File Upload"

Author

Exploit author

Besim

Platform

Exploit platform

php

Release date

Exploit published date

2020-05-12

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
# Exploit Title: qdPM 9.1 - Arbitrary File Upload
# Date: 2020-05-06
# Author: Besim ALTINOK
# Vendor Homepage: https://sourceforge.net/projects/qdpm/
# Software Link: https://sourceforge.net/projects/qdpm/
# Version: v9.1 (Maybe it affect other versions)
# Tested on: Xampp
# Credit: İsmail BOZKURT
# Remotely: Yes

Description
--------------------------------------------------------------------

When a normal user tries to update their profile, they can arbitrarily
upload files to the user_photo area. Because there are no file extension
controls. Additionally, the .htaccess file has some protection against
malicious .php file. But, the developer writes the wrong regex. So, the
Attacker can change extension as (.PHP) and run code on the server

.htaccess file content:
----------------------------------------------
# This is used to restrict access to this folder to anything other
# than images

# Prevents any script files from being accessed from the images folder
<FilesMatch "\.(php([0-9]|s)?|s?p?html|cgi|pl|exe)$">
   Order Deny,Allow
   Deny from all
</FilesMatch>

Vulnerable File-1: actions.class.php
----------------------------------------------
Vulnerable function: processForm
---------------------------------------------
Vulnerable area:
---------------------------------------------

<?php

protected function processForm(sfWebRequest $request, sfForm $form)
  {
    $files = $request->getFiles();
    $userPhoto = $files['users']['photo']['name'];

    $form->bind($request->getParameter($form->getName()),
$request->getFiles($form->getName()));
    if ($form->isValid())
    {
      $user = $this->getUser()->getAttribute('user');

      $this->checkUser($form['email']->getValue(),$user->getId());

      $form->setFieldValue('users_group_id',$user->getUsersGroupId());
      $form->setFieldValue('active',$user->getActive());

      $hasher = new PasswordHash(11, false);

      if(isset($form['new_password']))
      {
        if(strlen($form['new_password']->getValue())>0)
        {
          $form->setFieldValue('password',
$hasher->HashPassword($form['new_password']->getValue()));
        }
      }

      if(strlen($userPhoto)>0)
      {
        $userPhoto =  rand(111111,999999) . '-' . $userPhoto;
        $filename = sfConfig::get('sf_upload_dir') . '/users/' . $userPhoto;
        move_uploaded_file($files['users']['photo']['tmp_name'], $filename);
        $form->setFieldValue('photo', $userPhoto);

        app::image_resize($filename,$filename);
      }
      else
      {
        $form->setFieldValue('photo', $form['photo_preview']->getValue());
      }

?>
Release Date Title Type Platform Author
2020-10-27 "Sphider Search Engine 1.3.6 - 'word_upper_bound' RCE (Authenticated)" webapps php "Gurkirat Singh"
2020-10-27 "Sentrifugo 3.2 - File Upload Restriction Bypass (Authenticated)" webapps php "Gurkirat Singh"
2020-10-27 "Client Management System 1.0 - 'searchdata' SQL injection" webapps php "Serkan Sancar"
2020-10-26 "CMS Made Simple 2.1.6 - 'cntnt01detailtemplate' Server-Side Template Injection" webapps php "Gurkirat Singh"
2020-10-26 "PDW File Browser 1.3 - 'new_filename' Cross-Site Scripting (XSS)" webapps php "David Bimmel"
2020-10-26 "InoERP 0.7.2 - Remote Code Execution (Unauthenticated)" webapps php "Lyhin\'s Lab"
2020-10-26 "Online Health Care System 1.0 - Multiple Cross Site Scripting (Stored)" webapps php "Akıner Kısa"
2020-10-23 "Gym Management System 1.0 - 'id' SQL Injection" webapps php "Jyotsna Adhana"
2020-10-23 "Online Library Management System 1.0 - Arbitrary File Upload" webapps php "Jyotsna Adhana"
2020-10-23 "Point of Sales 1.0 - 'username' SQL Injection" webapps php "Jyotsna Adhana"
Release Date Title Type Platform Author
2020-05-12 "qdPM 9.1 - Arbitrary File Upload" webapps php Besim
2020-05-11 "CuteNews 2.1.2 - Arbitrary File Deletion" webapps php Besim
2020-05-06 "Booked Scheduler 2.7.7 - Authenticated Directory Traversal" webapps php Besim
2020-05-06 "webTareas 2.0.p8 - Arbitrary File Deletion" webapps php Besim
2020-05-06 "i-doit Open Source CMDB 1.14.1 - Arbitrary File Deletion" webapps php Besim
2020-05-05 "PhreeBooks ERP 5.2.5 - Remote Command Execution" webapps php Besim
2020-05-05 "webERP 4.15.1 - Unauthenticated Backup File Access" webapps php Besim
2020-04-29 "School ERP Pro 1.0 - Arbitrary File Read" webapps php Besim
2020-04-28 "School ERP Pro 1.0 - Remote Code Execution" webapps php Besim
2020-04-28 "School ERP Pro 1.0 - 'es_messagesid' SQL Injection" webapps php Besim
2020-04-27 "Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)" webapps php Besim
2020-04-27 "Netis E1+ V1.2.32533 - Unauthenticated WiFi Password Leak" webapps hardware Besim
2020-04-27 "Netis E1+ 1.2.32533 - Backdoor Account (root)" webapps hardware Besim
2020-04-27 "PHP-Fusion 9.03.50 - 'Edit Profile' Arbitrary File Upload" webapps php Besim
2020-04-24 "Edimax EW-7438RPn 1.13 - Remote Code Execution" webapps hardware Besim
2020-04-24 "EspoCRM 5.8.5 - Privilege Escalation" webapps multiple Besim
2020-04-23 "User Management System 2.0 - Authentication Bypass" webapps php Besim
2020-04-23 "User Management System 2.0 - Persistent Cross-Site Scripting" webapps php Besim
2020-04-23 "Complaint Management System 4.2 - Persistent Cross-Site Scripting" webapps php Besim
2020-04-23 "Complaint Management System 4.2 - Authentication Bypass" webapps php Besim
2020-04-23 "Complaint Management System 4.2 - Cross-Site Request Forgery (Delete User)" webapps php Besim
2020-04-22 "Edimax EW-7438RPn - Information Disclosure (WiFi Password)" webapps hardware Besim
2020-04-22 "Edimax EW-7438RPn - Cross-Site Request Forgery (MAC Filtering)" webapps hardware Besim
2016-10-31 "S9Y Serendipity 2.0.4 - Cross-Site Scripting" webapps php Besim
2016-10-23 "Zenbership 107 - Multiple Vulnerabilities" webapps php Besim
2016-10-19 "CNDSOFT 2.3 - Cross-Site Request Forgery / Arbitrary File Upload" webapps php Besim
2016-10-13 "Colorful Blog - Persistent Cross-Site Scripting" webapps php Besim
2016-10-13 "Thatware 0.4.6 - SQL Injection" webapps php Besim
2016-10-13 "Colorful Blog - Cross-Site Request Forgery (Change Admin Password)" webapps php Besim
2016-10-13 "JonhCMS 4.5.1 - SQL Injection" webapps php Besim
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48460/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.