boastMachine v3.1 Remote File Upload Vulnerability

vendor:

boastMachine

by:

alnjm33

7,5

CVSS

HIGH

Remote File Upload Vulnerability

434

CWE

Product Name: boastMachine

Affected Version From: 3.1

Affected Version To: 3.1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Version 3.1

2020

boastMachine v3.1 Remote File Upload Vulnerability

A vulnerability in boastMachine v3.1 allows an attacker to upload a malicious file to the server. An attacker can join the site using the register.php page, log in using the login.php page, and then upload a malicious file to the server using the files.php?form_id=new page. The malicious file can then be accessed at the /files/username_Shell.php.rar URL.

Mitigation:

Ensure that the application is configured to only allow the upload of files with the appropriate file extensions and that the application is configured to only allow the upload of files with the appropriate file size.

Source

Exploit-DB raw data:

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Exploit Title : boastMachine v3.1 Remote File Upload Vulnerability
Author: alnjm33
Software Link: http://boastology.com/pages/dload.php?id=bmachine-3.1.zip
Software Link2:http://boastology.com/pages/dload.php?id=bmachine-3.1.rar
Version: 3.1
Tested on: Version 3.1
My home : Sec-war.com<http://Sec-war.com>
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
==========================================Dork==========================================
( Powered by boastMachine v3.1 )
================================Exploit=============================================
First join in the Site
/Server/path/register.php
After that
login in the Site
/Server/path/login.php
After Login
go to this link
/Server/path/bmc/files.php?form_id=new
Now upload your shell like ( Shell.php.rar )
Now you can find your shell here
/Server/path/files/username_Shell.php.rar
e.g
http://server/hp_boastMachine/files/alnjm33_aasaa.php.rar
=======================================================================================
Greetz to :PrEdAtOr -Sh0ot3R - xXx - Mu$L!m-h4ck3r - ahmadso - JaMbA - RoOt_EgY- jago-dz - XR57 all Sec-War.com members