vendor:
Church Management System
by:
Murat DEMIRCI
8,8
CVSS
HIGH
Unrestricted File Upload to Remote Code Execution
434
CWE
Product Name: Church Management System
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:sourcecodester:church_management_system:1.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 10
2021
Church Management System 1.0 – Unrestricted File Upload to Remote Code Execution (Authenticated)
An authenticated user can upload a malicious file to the Church Management System 1.0, which can be used to execute arbitrary code on the server. To exploit this vulnerability, an attacker must first login to any user account and change the profile picture. Then, the attacker can upload any PHP shell by altering its extension to .jpg or .png (e.g. test.php.jpg). Before uploading the file, the attacker must intercept the traffic using a proxy. The attacker can then change the test.php.jpg file to test.php and click forward. Finally, the attacker can find the test.php file path and execute any command.
Mitigation:
The best way to mitigate this vulnerability is to restrict the types of files that can be uploaded to the server. Additionally, the server should be configured to only allow certain file extensions, and any files that are uploaded should be scanned for malicious content.
