Create a gist now

Instantly share code, notes, and snippets.

Embed
What would you like to do?
1. Remote Code Injection in gps-server.net SAAS CMS (<=3.0)
The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by
<?php system($_GET[cmd]); ?>
in a login request. Each POST request goes through mysql_real_escape_string() function which will add slashes behind quotes so the payload code shouldn't include any quote. The header of the file where code is injected allows only Admin to view the file which makes it less of a RCE. But there is another vulnerability (explained below) which allows an attacker to hijack account hence making the RCE exploitable with 100% success.
2. Admin Account Hijack in gps-server.net SAAS CMS (2.x)
gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.
@Imranjunnaid

This comment has been minimized.

Show comment
Hide comment
@Imranjunnaid

Imranjunnaid Jun 4, 2018

dear
do you have source code for the gps-server.net app

if you have and having an expertise with this code then you can contact me on my whatsapp no : +923214464418

dear
do you have source code for the gps-server.net app

if you have and having an expertise with this code then you can contact me on my whatsapp no : +923214464418

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment