Vendor and Product Information:

• Vendor: Project Worlds
• Product: Complaint Management System
• Product URL: Complaint Management System

Vulnerability Details:

• Vulnerability Location: File Upload Functionality
• Vulnerability Type: Remote Code Execution (RCE)
• Affected Component: [users/register-complaint.php]
• Severity: Critical

Description:

Vulnerable Family:

The vulnerability exists in the file upload functionality of the [Product Name]. The application fails to properly validate file uploads, allowing attackers to upload and execute arbitrary PHP files.

Current Situation:

Attackers can exploit this vulnerability by logging in to a user account (e.g., [email protected]), navigating to the "Lodge Complaint" section, and uploading a malicious PHP file. By intercepting the upload request with tools like Burp Suite, attackers can modify the content of the PHP file to contain code that executes system commands. Upon successful upload, attackers can trigger the execution of the uploaded PHP file by viewing the details of the complaint and choosing the uploaded file, leading to remote code execution on the server.

Proof of Concept (PoC):

1. Accessing the Vulnerable Function:

   • Log in to the application using the credentials of a valid user account (e.g., [email protected]).
   • Navigate to the "Lodge Complaint" section of the application.

2. Exploiting the Vulnerability:

   • Fill out the complaint form and attach a PHP file with arbitrary code.
   • Intercept the upload request using Burp Suite or similar tools.
   • Modify the content of the uploaded PHP file to execute system commands (e.g., <?php system($_GET['torada']); ?>).
   • Forward the modified request to complete the file upload.

3. Triggering Remote Code Execution:

   • Navigate to the "Complaint History" section of the application.
   • View the details of the last complaint made, which includes the uploaded PHP file.
   • Choose the uploaded PHP file to execute the shell named connect.php, as demonstrated in the video.
   • we execute command like whoami and dir as shown at the video

    [6cb49487-ade4-4833-8596-ff90e42af204.mp4](<https://prod-files-secure.s3.us-west-2.amazonaws.com/d243d6db-bde7-47a3-8189-a6cf2583781e/c734dade-1613-43eb-8a6e-b32126a9c5ca/6cb49487-ade4-4833-8596-ff90e42af204.mp4>)
   

Impact:

The impact of this vulnerability includes: