Description
An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header (access=3) with HTTP requests. The application’s upload mechanism fails to restrict file types and does not validate or sanitize user-supplied input, allowing attackers to upload malicious .php scripts. Authentication can be bypassed entirely by supplying a specially crafted cookie (access=3), granting access to the upload functionality without valid credentials. If file uploads are enabled on the server, the attacker can upload a web shell and gain remote code execution with the privileges of the web server user, potentially leading to full system compromise.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Simple E-Document Simple E-Document
Default version status: unaffected
3.0 to ≤ 3.1affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/simple_e_document_upload_exec.rb ↗
- https://www.exploit-db.com/exploits/31264 ↗
- https://sourceforge.net/projects/simplee-doc/ ↗
- https://www.vulncheck.com/advisories/simple-edocument-abitrary-file-upload-rce ↗