TicketPlus - Support Ticket Management System - Arbitrary File Upload

vendor:

TicketPlus - Support Ticket Management System

by:

Ihsan Sencan

7,5

CVSS

HIGH

Arbitrary File Upload

434

CWE

Product Name: TicketPlus - Support Ticket Management System

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WiN7_x64/KaLiLinuX_x64

2017

TicketPlus – Support Ticket Management System – Arbitrary File Upload

The vulnerability allows an users upload arbitrary file. The vulnerability is located in the 'updateProfile' function with the failure of the file upload validation. Attacker can upload arbitrary file and execute it in the application path.

Mitigation:

Input validation should be done to prevent arbitrary file uploads.

Source

Exploit-DB raw data:

# # # # # 
# Exploit Title: TicketPlus - Support Ticket Management System - Arbitrary File Upload
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://teamworktec.com/
# Software Link: https://codecanyon.net/item/ticketplus-support-ticket-management-system/20221316
# Demo: http://sportsgrand.com/demo/ticket_plus/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# 
# The vulnerability allows an users upload arbitrary file....
# 
# Vulnerable Source:
# 
#     public function updateProfile(Request $request) {
#         $this->validate($request, [
#             'name' => 'required|max:32',
#             'username' => 'required|max:32|unique:users,username,'.Auth::id(),
#             'email' => 'email|max:40|unique:users,email,'.Auth::id()
#         ]);
# 
#         $user = User::find(Auth::id());
#         $user->name = $request->name;
#         $user->username = $request->username;
#         $user->email = $request->email;
#         if(!empty($request->file)){
#             $request->file->move('uploads', $request->file->getClientOriginalName());
#             $user->avatar = $request->file->getClientOriginalName();
#         }
#         $user->save();
#         return redirect()->back()->withMessage('Profile updated successfully');
#     }
# 	
# Proof of Concept: 
# 
# http://localhost/[PATH]/profile/settings
# http://localhost/[PATH]/uploads/[FILE]
# 
# Etc..
# # # # #