============================================================================================================================================= | # Title : Event Registration and Attendance System 1.0 wysiwyg code injection Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) | | # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/online-news-portal.zip | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] infected item : admin_class.php $data .= ", content = '".htmlentities(str_replace("'","’",$content))."' "; if(!empty($_FILES['cover']['tmp_name'])){ $fname = strtotime(date("Y-m-d H:i"))."_".(str_replace(" ","-",$_FILES['cover']['name'])); $move = move_uploaded_file($_FILES['cover']['tmp_name'],'../assets/uploads/content_images/'. $fname); $protocol = strtolower(substr($_SERVER["SERVER_PROTOCOL"],0,5))=='https'?'https':'http'; $hostName = $_SERVER['HTTP_HOST']; $path =explode('/',$_SERVER['PHP_SELF']); $currentPath = '/'.$path[1]; if($move){ $data .= ", cover_img='$fname' "; } } [+] Line 27 : Set your target url. [+] This payload is WYSIWYG based The page can be edited remotely and a malicious executable file can be uploaded ,via summernote is a WYSIWYG editor V: 0.8.18. [+] save payload as poc.html [+] payload : Manage About Page
[+] path of evil : http://127.0.0.1/news_portal/assets/uploads/content_images/shell.php Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ==========================================================================