Unrestricted File Upload RCE in projectworlds Online Time Table Generator

Critical Vulnerability Information Affected Product Project Name: projectworlds Online Time Table Generator Portal - Source code Affected Version: Current version (as of March 14, 2023) Fixed Version: No patch has been disclosed for this vulnerability yet Vulnerable File File at Risk: /admin/updatestudent.php Software Link Download Link Issue Type CWE ID: CWE-434: Unrestricted Upload of File with Dangerous Type Vulnerability Type: Remote Code Execution via Unrestricted File Upload Root Cause The file upload module fails to properly validate the file type and extension provided by the user. Attackers can bypass security controls by creating malicious files (e.g., "shell.php") and submitting them through the upload form. Impact Malware Distribution Remote Code Execution (RCE) Data Leakage Denial of Service (DoS) Web Shell Installation Bypass of Security Controls Reputation Damage Description The file upload module on the portal site does not validate file types or extensions. By creating a malicious file (e.g., "shell.php") and submitting it via the upload form, attackers can bypass security controls. When updating student records at "/admin/updatestudent.php" using the email address "jack@gmail.com" and uploading a ".php" file with the following content: The server stores the file as "student/image/jack@gmail.com" without any sanitization, allowing access to the uploaded file via HTTP requests. Vulnerability Details and PoC Vulnerable Parameter: File upload field (POST request) Reproduction Steps: 1. Navigate to 2. Upload a ".php" file using any student ID and email address 3. Successfully access the file path and execute the function Recommended Remediation Input Validation and Filtering: Ensure parameters only accept expected characters (e.g., digits or letters) to prevent path traversal attacks. Filename Sanitization: Strictly validate uploaded filenames. Avoid using user-provided original names and restrict allowed file extensions. Randomized Storage Names: Generate random filenames to prevent attackers from directly accessing malicious files. File Type Validation: Validate file extensions and MIME types to detect spoofed formats. Storage Directory Permissions: Store uploaded files in a non-web-accessible directory, or configure the server to disable script execution. Server Configuration: For Apache/Nginx, restrict execution permissions in the upload directory (e.g., ). Error Handling: Avoid exposing internal path details; use custom error pages.

Goal Reached Thanks to every supporter — we hit 100%!

Unrestricted File Upload RCE in projectworlds Online Time Table Generator

More from this source