************************************************************************************ # Title: Complaint Management System v1.0- unrestricted file upload leading to RCE # Exploit Author: Mohamed Elobeid (0b3!d) # Date: 2020-08-21 # Vendor Homepage: https://www.sourcecodester.com/php/14206/complaint-management-system.html # Software Link: https://www.sourcecodester.com/download-code?nid=14206&title=Complaint+Management+System # Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4 # Description: Users can upload php files and then can execute these file from the url http://target/Complaint%20Management%20System/users/complaintdocs/phpinfo.php leading to RCE . #POC 1-create phpinfo.php with the content "<?php phpinfo(); ?>"" 2-login as a normal user, register a new compliant and attach phpinfo.php 3--browse your submitted complaint and view the attached file ************************************************************************************************