> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/kashz-jewels/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/kashz-jewels/services/b2evolution.md).

# b2evolution

## interesting stuff

```bash
# login page
/htsrv/login.php

# config file
/conf/_basic_config.php
```

## File upload (authenticated as new user is fine)

Try as version doesn't affect this vulnerability.

v6.8.2 | v6.9.3

```bash
# as user: kashz; while commenting on post, upload a .php file 
# hovering on the "download-icon" (not file-name) shows upload path
```