(N times) ufida icc website customer service system Arbitrary File Upload Vulnerability

Previous Article:

Ufida icc website Customer Service System Remote Code Execution Vulnerability and repair
Ufida icc website customer service system Arbitrary File Upload Vulnerability
Arbitrary File Upload Vulnerability in the customer service system of ufida icc website

The ufida icc website's customer service system's arbitrary file upload vulnerability has been cracked many times. The last time I tried it, I checked the code and found that there was another place for arbitrary upload. The official repair is indeed incomplete !!
Detailed Description: vulnerability file:/5107/include/sendmsg. class. php

Function saveAttach (){
Global $ errorMsg, $ lang, $ CONFIG, $ COMMON, $ basePath;

If (empty ($ _ FILES ["attach"] ["name"]) return '';

// Generate a message attachment to save the directory. www.2cto.com
$ Path = 'data/leavewordfile/'. date ("Ymd ").'/';
If (! Is_dir ($ CONFIG-> basePath. $ path )){
$ COMMON-> createDir ($ CONFIG-> basePath. $ path );
}

// File name.
$ FileName = date ('ymdhis '). rand (100000,999 999). strrchr ($ _ FILES ['Attach'] ['name'], '.');
$ SysFileName = $ CONFIG-> basePath. $ path. $ fileName;
$ UrlFileName = $ CONFIG-> baseUrl. $ path. $ fileName;

If (! Empty ($ _ FILES ['Attach '] ['name']) {
// Check whether the file is legal when the attachment file is not empty.
If ($ this-> checkFileType (strrchr ($ _ FILES ['Attach '] ['name'],'. ') {
// The attachment file type is invalid //
$ ErrorMsg. = $ lang ['Attach _ type'];
} Else if ($ _ FILES ['Attach '] ['SIZE']> = 5242880 | $ _ FILES ['Attach'] ['SIZE'] <= 0 ){
// The attachment file size is invalid/
$ ErrorMsg. = $ lang ['Attach _ size'];
}
}

// Upload an attachment //
Move_uploaded_file ($ _ FILES ["attach"] ["tmp_name"], $ sysFileName );
Chmod ($ sysFileName, 0444 );
Return $ urlFileName;
}

Not filtered .. As a result, php files can be uploaded directly.

Specific use:

Open: http://www.2cto.com/5107/msg/sendmsg. php attachment where directly transfer php

The uploaded address will be in/data/leavewordfile/date/the file name. php

The file name is displayed immediately. But you can use a tool to guess. Basically, it's just a matter of time!

 

 

Solution: Filter and pull.

I hope I won't try to find your vulnerabilities again ..
Author: ghost Brother