PodHawk Arbitary File Upload Vulnerability

vendor:

PodHawk

by:

CWH Underground

9,3

CVSS

HIGH

Unrestricted File Upload

N/A

CWE

Product Name: PodHawk

Affected Version From: 1.85

Affected Version To: 1.85

Patch Exists: YES

Related CWE: N/A

CPE: a:podhawk:podhawk

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux

2013

PodHawk Arbitary File Upload Vulnerability

This application has an upload feature that allows an authenticated user with Administrator roles or User roles to upload arbitrary files cause remote code execution by simply request it.

Mitigation:

Upgrade to the latest version of PodHawk

Source

Exploit-DB raw data:

# Exploit Title   : PodHawk Arbitary File Upload Vulnerability
# Date            : 23 June 2013
# Exploit Author  : CWH Underground
# Site            : www.2600.in.th
# Vendor Homepage : http://podhawk.sourceforge.net
# Software Link   : http://jaist.dl.sourceforge.net/project/podhawk/podhawk/podhawk_1_85/podhawk_1_85.zip
# Version         : 1.85
# Tested on       : Window and Linux
  
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /        
  / XXXXXX /
 (________(          
  `------'
  
#####################################################
VULNERABILITY: Unrestricted File Upload 
#####################################################
  
/podhawk/uploadify/uploadify.php (LINE: 33-44)
 
----------------------------------------------------------------------------- 
if (!empty($_FILES))
{
	if ($_GET['upload_type'] == 'audio')
	{
		$writable = 'upload';
		$targetPath = UPLOAD_PATH;
	}
	else
	{
		$writable = 'images';
		$targetPath = IMAGES_PATH;
	}
-----------------------------------------------------------------------------  
  
#####################################################
DESCRIPTION
#####################################################
  
This application has an upload feature that allows an authenticated user
with Administrator roles or User roles to upload arbitrary files cause remote code execution by simply request it.

#####################################################
EXPLOIT POC
#####################################################
  
1. Log On User account (Author) account
2. Access http://target/podhawk/podhawk/index.php?page=record1
3. Upload a file to the upload folder via "Browse"
4. Upload PHP shell (shell.php) and upload it
5. For access shell, http://target/podhawk/upload/shell.php
6. Server Compromised !!
  
################################################################################################################
 Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
################################################################################################################