Tejari Arbitrary File Upload

------------------------------------------------------------------
Vulnerability Type: Unrestricted File Upload
Vendor of Product: Tejari
Affected Product Code Base: Bravo Solution
Vulnerability Type: Unrestricted File Upload
Vendor of Product: Tejari
Affected Product Code Base: Bravo Solution
Affected Component: Web Interface Management.
Attack Type: Local - Authenticated
Impact: Malicous File Upload
-----------------------------------------------------------------

Product description:
Brao Tejari is a strategic procurement platform that enables
organizations to generate more value, influence innovation and reduce
risk powered by a unique supplier-centered approach that integrates
supplier lifetime value throughout the entire procurement process

Attack Scenario:
The Web Interface of the Bravo Tejari procurement portal does not use
perform server-side check on uploaded files. An attacker who has
access to the application can bypass client-side checks and uploads
malicious executable, pdf's and web-shells on the web-server.

Affected Product Link:
https://xxxxxx.xxxx.com/esop/evm/OPPreliminaryForms.do?formId=857

Impact:
The uploaded files are not properly validated by the application. An
attacker can take advantage of this vulnerability and upload malicious
executable files to compromise the application.

Recommendation:
All uploaded files must be validated on both the client and server
side before storing them on the server.


Credit: Arvind Vishwakarma
http://ultimateone1.blogspot.ae/

Vulnerability Timeline:

12th December 2017 a Vulnerability Discovered
23rd December 2017 a Contacted Vendor a No Response
7th January 2018 a Contacted Vendor again a No Response
15th February 2018 a Vulnerability Disclosed