Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web :: CMS / Portals :: b06-5548.htm

how to trick most of cms avatar upload filter
how to trick most of cms avatar upload filter
how to trick most of cms avatar upload filter

//how to trick cms avatar upload 
//exemple for : RunCms (PoC)
//Bug : avatar/php-shell upload 
//Product: RunCms
//RISK: hight

you can upload a crafted picture on most of cms .
there's actually one protection agains that:
it's to reconvert the picture name uploaded ( see = ) 
so the picture called picture.jpg will be renamed has 12d32f2jk25r543jk2ljn543.jpg 

now on a webserver , a script is called & executed with the extension , so if you rename & upload a crafted picture , like this : 
you will get the php code in the picture executed .(if there's some php code in the crafted picture)
the reverse ( http://site.jpg.php ) will never work , it's usually because the avatar upload filter look for the last extension. 

so now we need to trick the upload filter , if you do a simple php script named "script.php" ,it will never work , 
our goal is to trick the avatar filter , so we need a reel picture .
then you need to take a good file editor , like: notepad++ 
(you can take whatever picture , and edit it without destroying it .)
we need to put some php code AFTER the picture code . 
when  it's done , try the picture if it still work , if yes , we are ok :).
here's an exemple of a crafted picture : 
just upload the picture has your avatar , for Runcms and do a right click ===> property , on your avatar , look at the link ,
and call it with firefox , opera , safary , etc , once this is done you have a php backdoor uploaded in . 
usually in:[runcms_path]/images/avatar/sp.php.jpg 

ps:this doesn't work with IE .

regards , 

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH