[+] :: Title: LaraPortfolio CMS Script v1.2 WebShell Upload & Stored XSS Injection [+] :: Author: QUIXSS [+] :: Date: 2019-04-18 [+] :: Software: LaraPortfolio CMS Script v1.2 [+] :: Technical Details & Description: # Weak security measures like bad input fields data filtering and no restriction for .PHP5/.PHP7 file upload has been discovered in the «LaraPortfolio CMS Script». Current version of this web-application is 1.2. [+] :: Demo Website: # https://codecanyon.net/item/laraportfolio-cms-script/21160926 # Frontend: http://fluxkart.com/laraportfolio # Backend: http://fluxkart.com/laraportfolio/login # Login: admin, Password: admin [+] :: Special Note: # Author of this web-application was warned about bad security measures. Nothing has changed. [+] :: PoC Upload: # http://fluxkart.com/laraportfolio/local/images/media/15556222204009.php # http://fluxkart.com/laraportfolio/local/app/Http/Controllers/SystemController.php?cmd=ls%20-la [+] :: PoC #1 [WebShell Upload]: # Authorize on the demo website for tests: http://fluxkart.com/laraportfolio/login (login & password is admin). Then go to the settings page: http://fluxkart.com/laraportfolio/admin/settings # Vulnerable file upload fields is «Logo» and «Animated Gif Image». You can upload any .PHP file u want, just change file type from .PHP to .PHP7 (cuz PHP v7.X is enabled on this server). Next step is to submit this form, but by default author disabled it by using special class and attribute «disabled». It's easy to bypass: «inspect» this button in the Developers Console, edit code as HTML and delete class «btndisable», then change type attribute from «button» to «submit». At the end of this trick you must see this code: <button type="submit" class="btn btn-success">Submit</button>. That's it! Submit the form and your uploaded .PHP7 file will be here: http://fluxkart.com/laraportfolio/local/images/media/XXXXX.php7 (or u can «inspect» broken image to get the link). [+] :: PoC #2 [Stored XSS Injection]: # Authorize on the demo website for tests: http://fluxkart.com/laraportfolio/login (login & password is admin). Then go to the settings page: http://fluxkart.com/laraportfolio/admin/settings # Almost each input field is vulnerable for Stored XSS Injections, but «Footer Copyright» field is more useful one.