This exploit demonstrates an arbitrary file upload vulnerability in Zomato Clone Script, allowing an attacker to upload a malicious PHP file disguised as an image (e.g., info.php.jpg) and execute arbitrary code on the server. The PoC includes a crafted HTTP POST request with a multipart form-data payload that bypasses file extension checks.
Classification
Working Poc 95%
Target:
Zomato Clone Script (version N/A)
No auth needed
Prerequisites:
Access to the vulnerable web application · Ability to send HTTP POST requests