This exploit demonstrates a remote file upload vulnerability in boastMachine v3.1, allowing an authenticated attacker to upload a malicious file (e.g., a shell) by bypassing file extension restrictions via a double extension (e.g., .php.rar). The uploaded file can then be accessed and executed.
Classification
Working Poc 90%
Target:
boastMachine v3.1
Auth required
Prerequisites:
Access to the registration and login pages · Valid credentials for authentication · Ability to upload files via the files.php endpoint