Headline
CVE-2022-1837: webray.com.cn/HCS_add_register.php_File_Upload_Getshell.md at main · Xor-Gerke/webray.com.cn
A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.php?link=registerand. The manipulation with the input <?php phpinfo();?> leads to code execution. The attack may be launched remotely but demands an authentication. Exploit details have been disclosed to the public.
Home Clean Services Management System add_register.php File Upload Getshell****Exploit Title: Home Clean Services Management System add_register.php File Upload Getshell****Exploit Author: webraybtl@webray.com.cn inc****Vendor Homepage: https://www.sourcecodester.com/php/15293/home-clean-service-free-source-code.html****Software Link: https://www.sourcecodester.com/download-code?nid=15293&title=Home+Clean+Service+System+in+PHP+Free+Source+Code****Version: Home Clean Services Management System 1.0****Tested on: Windows Server 2008 R2 Enterprise, Apache ,Mysql****Description
At the file upload function, the application system checks the validity of the file type, format, and content uploaded by the user, so that attackers can upload Webshell (.php, .jsp, asp, etc.) malicious script files or files in unexpected formats, such as: HTML files, SHTML files, etc., at the same time, you can use characters such as directory jump or control the upload directory to directly upload files to the Web directory or any directory, which may lead to the execution of arbitrary malicious script files on the remote server, thereby directly obtaining application system permissions.Home Clean Services Management System does not filter the content correctly at the “register” module, resulting in the generation of File upload.
Payload used:
<?php phpinfo();?>
Proof of Concept
Login the CMS. Admin Default Access: Email: admin Password: admin
Open Page http://172.24.5.102/HCS/public_html/register.php?link=registerand
Put phpinfo payload (<?php phpinfo();?>) in the images content and click on Register to publish the page
Viewing the successfully published page,Open Page http://172.24.5.102/HCS/public_html/uploads/8036-test.php ,We can see the phpinfo.