Attack Chain

1. Authentication and Initial Access: An attacker obtains valid credentials for a NotrinosERP user account with the SA_EMPLOYEE permission.
2. CSRF Token Retrieval: The attacker logs into NotrinosERP and navigates to the HRM employee "Documents" tab (/hrm/manage/employees.php?_tabs_sel=tab_documents) to obtain a valid CSRF token (_token) from the HTML response.
3. Malicious File Upload Request: The attacker crafts a multipart POST request to /hrm/manage/employees.php including the obtained CSRF token, a valid doc_type_id, and a malicious PHP file (e.g., shell.php) containing a web shell payload (e.g., <?php system($_GET['c']); ?>) in the doc_file field.
4. Arbitrary File Write: Due to a lack of validation in the tab_documents() function, NotrinosERP stores the malicious PHP file with its original .php extension verbatim in a web-accessible directory, typically company/0/documents/employees/.
5. Web Shell URL Discovery: The system echoes the exact path to the uploaded file into a clickable "View" link in the employee "Documents" tab, allowing the attacker to discover the web shell's URL (e.g., /company/0/documents/employees/1_<unix_ts>_shell.php).
6. Remote Code Execution: The attacker sends a GET request to the discovered web shell URL, passing OS commands as a parameter (e.g., ?c=id or ?c=whoami), which are then executed by the web server on the underlying operating system.

Impact

Successful exploitation results in full remote code execution (RCE) on the server hosting NotrinosERP. This allows an authenticated attacker, holding the SA_EMPLOYEE role (which may not be an administrator role by default), to compromise the entire system. The impact includes unauthorized access to sensitive data, potential data exfiltration, modification or deletion of critical information, and the ability to establish persistent access. The vulnerability also exposes the system to secondary issues like stored Cross-Site Scripting (XSS), which could impact other users.

Recommendation

• Deploy the Sigma rule "Detect NotrinosERP Web Shell Upload Attempt" to your SIEM to identify suspicious multipart file uploads.
• Implement robust file upload validation at the web server level, specifically blocking executable extensions like .php in the /company/ directory.
• Ensure web server logs for your NotrinosERP instance include request_body content for HTTP POST requests to facilitate detection of malicious payloads.
• Apply available patches for NotrinosERP to address arbitrary file upload vulnerabilities. The suggested fix involves not using client filenames, enforcing extension/MIME allow-lists, and storing uploads outside the web root.
• Restrict SA_EMPLOYEE role permissions to only trusted personnel.