[FD] Centraleyezer: Unrestricted File Upload -[CVE-2019-12271]

[infinitybuzz via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

Centraleyezer: Unrestricted File Upload -[CVE-2019-12271]

Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a 
dangerous type, because the feature of adding “.jpg” to any uploaded filename 
is not enforced on the server side.

The image upload is vulnerable to bypass, the file upload adds .jpg extension 
to every file sent, but on client side, so I could intercept the request and 
change it to .php. I uploaded a simple shell and was able to execute commands 
as user www-data on the server.

more information:

https://link.medium.com/Y2S4ZJbMy1

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/