gpEasy CMS 4.0 Shell Upload

`# Exploit Title : gpEasy CMS Malicious File Upload  
# Date : 4 June 2013  
# Exploit Author : CWH Underground  
# Site : www.2600.in.th  
# Vendor Homepage : http://gpeasy.com/  
# Software Link : http://gpeasy.com/Special_gpEasy?cmd=dlzip  
# Version : 4.0  
# Tested on : Window and Linux  
  
,--^----------,--------,-----,-------^--,  
| ||||||||| `--------' | O .. CWH Underground Hacking Team ..  
`+---------------------------^----------|  
`\_,-------, _________________________|  
/ XXXXXX /`| /  
/ XXXXXX / `\ /  
/ XXXXXX /\______(  
/ XXXXXX /   
/ XXXXXX /  
(________(   
`------'  
  
  
#####################################################  
DESCRIPTION  
#####################################################  
  
gpEasy CMS that permission is provided a file upload function to authenticated users. Allows for write/read/edit/delete download arbitrary  
file uploaded (Upload location is centralized) , which results attacker might arbitrary write/read/edit/delete files and folders.  
  
Moreover, Upload function allow attacker to upload PHP file lead attacker to compromise system.In order to exploit the vulnerability   
a valid user in the web is required.  
  
#####################################################  
EXPLOIT POC  
#####################################################  
  
1. Logged in as User's privilege   
2. Access http://target/gpeasy/Admin_Uploaded  
3. Able to access centralize upload folder  
4. Malicious File Upload (Shell.php)  
5. For access shell, http://target/gpeasy/data/_uploaded/Shell.php  
6. Server Compromised !!  
  
################################################################################################################  
Greetz : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2  
################################################################################################################  
  
`