Tejari suffers from an arbitrary file upload vulnerability.
fe73773199d81547dabdd4fe82e4b5d6------------------------------------------------------------------
Vulnerability Type: Unrestricted File Upload
Vendor of Product: Tejari
Affected Product Code Base: Bravo Solution
Affected Component: Web Interface Management.
Attack Type: Local - Authenticated
Impact: Malicous File Upload
-----------------------------------------------------------------
Product description:
Brao Tejari is a strategic procurement platform that enables
organizations to generate more value, influence innovation and reduce
risk powered by a unique supplier-centered approach that integrates
supplier lifetime value throughout the entire procurement process
Attack Scenario:
The Web Interface of the Bravo Tejari procurement portal does not use
perform server-side check on uploaded files. An attacker who has
access to the application can bypass client-side checks and uploads
malicious executable, pdf's and web-shells on the web-server.
Affected Product Link:
https://xxxxxx.xxxx.com/esop/evm/OPPreliminaryForms.do?formId=857
Impact:
The uploaded files are not properly validated by the application. An
attacker can take advantage of this vulnerability and upload malicious
executable files to compromise the application.
Recommendation:
All uploaded files must be validated on both the client and server
side before storing them on the server.
Credit: Arvind Vishwakarma
http://ultimateone1.blogspot.ae/
Vulnerability Timeline:
12th December 2017 a Vulnerability Discovered
23rd December 2017 a Contacted Vendor a No Response
7th January 2018 a Contacted Vendor again a No Response
15th February 2018 a Vulnerability Disclosed