Tejari Arbitrary File Upload

Tejari suffers from an arbitrary file upload vulnerability.

MD5 | fe73773199d81547dabdd4fe82e4b5d6

Vulnerability Type: Unrestricted File Upload
Vendor of Product: Tejari
Affected Product Code Base: Bravo Solution
Affected Component: Web Interface Management.
Attack Type: Local - Authenticated
Impact: Malicous File Upload

Product description:
Brao Tejari is a strategic procurement platform that enables
organizations to generate more value, influence innovation and reduce
risk powered by a unique supplier-centered approach that integrates
supplier lifetime value throughout the entire procurement process

Attack Scenario:
The Web Interface of the Bravo Tejari procurement portal does not use
perform server-side check on uploaded files. An attacker who has
access to the application can bypass client-side checks and uploads
malicious executable, pdf's and web-shells on the web-server.

Affected Product Link:

The uploaded files are not properly validated by the application. An
attacker can take advantage of this vulnerability and upload malicious
executable files to compromise the application.

All uploaded files must be validated on both the client and server
side before storing them on the server.

Credit: Arvind Vishwakarma

Vulnerability Timeline:

12th December 2017 a Vulnerability Discovered
23rd December 2017 a Contacted Vendor a No Response
7th January 2018 a Contacted Vendor again a No Response
15th February 2018 a Vulnerability Disclosed

Related Posts