CVE-2018-25412
CRITICALDelta Sql 1.8.2 Arbitrary File Upload via docs_upload.php
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25412. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in Delta Sql 1.8.2, allowing an attacker to upload a malicious PHP file via a multipart/form-data POST request to docs_upload.php. The uploaded file can then be accessed at /upload/[FILE], leading to remote code execution.
Description
Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to docs_upload.php with crafted multipart form data. Attackers can upload PHP files with arbitrary content to the upload directory and execute them on the server for remote code execution.
Exploits (1)
This exploit demonstrates an arbitrary file upload vulnerability in Delta Sql 1.8.2, allowing an attacker to upload a malicious PHP file via a multipart/form-data POST request to docs_upload.php. The uploaded file can then be accessed at /upload/[FILE], leading to remote code execution.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H