webPromedium
KnowledgeForge — File Upload RCE via MIME Type Confusion
hackadvisor
Task: PHP knowledge base platform (KnowledgeForge v2.4.1, based on phpMyFAQ) behind nginx reverse proxy with restrictive location matching that blocks direct access to all routes. Solution: Bypassed nginx routing via double-slash prefix (//index.php/), then exploited CVE-2024-28105 by injecting .php into the lang parameter of category image upload with a GIF polyglot webshell, achieving RCE as root.
$ ls tags/ techniques/
rcephpfile_uploadwebshellapachenginxgif_polyglotdecoy_flagreverse_proxymime_typepath_normalizationphpmyfaqcve_2024_28105lang_parameter_injectionnginx_location_bypassdouble_slashcategory_image
decoy_flag_identificationproxy_backend_routing_desyncnginx_double_slash_location_bypassgif_polyglot_php_webshellmime_type_confusion_extension_bypasslang_parameter_filename_injectioncve_2024_28105_phpmyfaq_rce
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 254 — PageForge — ZIP Upload File Type Bypass to RCE— hackadvisor
- [web][Pro]PageForge— hackadvisor
- [web][Pro]Lab 94 — MediaForge — ImageMagick Command Injection via File Upload (ImageTragick)— hackadvisor
- [web][Pro]BillForge — LFI to RCE via Nginx Log Poisoning— hackadvisor
- [web][Pro]Lab 25 — DocuForge — RCE via Dompdf Font Cache Exploitation— hackadvisor