# Uncovering a Command Injection, $2400 Bounty

Admin panel found via ASN recon with default admin:admin creds exposed changelogo.php, where the filename field was vulnerable to shell command injection.

- Payout: $2,400
- Severity: high
- Program: -
- Credited: 0xrz
- Disclosed: 2023-10-14
- Write-up quality: 6/10
- Original: https://blog.voorivex.team/uncovering-a-command-injection-2400-bounty
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-voorivex-team-uncovering-a-command-injection-2400-bounty
- Tags: domain:web impact:internal-access impact:rce kind:bounty platform:blog sev:high tech:php technique:recon vuln:command-injection vuln:file-upload

**Target:** PHP admin panel logo-upload endpoint (changelogo.php)
**Root cause:** The filename parameter of the logo upload form is passed to a shell without sanitization, allowing command injection via shell metacharacters like `||`.
**Steps:**
1. Enumerate company ASNs via bgpview.io, expand CIDRs with `whois -h whois.radb.net -- '-i origin AS123' | grep -Eo "([0-9.]+){4}/[0-9]+" | uniq | mapcidr -silent | httpx`
2. Fingerprint live hosts; identify PHP admin panel
3. Directory fuzz with ffuf, find `/Config/` returning 401
4. Log in with default `admin:admin`
5. Locate `.rar` in images dir containing docs referencing `changelogo.php`
6. Access `changelogo.php`; observe file-upload form in Burp
7. Upload a `.gif` to confirm upload works
8. Inject in filename: `filename="test || sleep 30 ||.gif"` to confirm command execution
**How found:** ASN/CIDR recon plus Shodan surfaced ~200 IPs; one looked like an admin panel. Wappalyzer flagged PHP, SQLi failed, ffuf found /Config/ with 401, and default admin:admin worked. A leaked .rar in the images directory contained Chinese admin docs referencing changelogo.php, which redirected in browser but showed an upload form in Burp. After GIF upload succeeded and webshell was blocked by extension filter, they tried injection in the filename field itself.
**Exploitation:** Authenticated (default creds) attacker uploads a file with a crafted filename containing `|| sleep 30 ||`, causing the server to execute arbitrary shell commands during upload processing.
**Escalation:** Same fingerprint swept across the ASN IP range revealed a second instance with the identical bug; reported together.
**Insight:** When upload extension filters block webshells, pivot to injecting into the filename parameter itself — the filename often reaches a shell or filesystem call unsanitized even when content is validated. Also: leaked .rar/.doc files in web-accessible asset directories frequently document hidden admin endpoints.